1-byte heap OOB read in OUT-data transfer path of imm_do_scsi

Summary

In data-transfer loop OUT-direction branch (device status 0x88 wants more data) selects transfer length of 2 whenever fewer than VP0_SECTOR_SIZE(512) bytes remain. Preceding guard at :739 only guarantees at least 1 byte remains. When exactly 1 byte left imm_outstr(vpo &buffer[*count] 2) reads 2 bytes - 1-byte OOB read of adjacent kernel heap. Leaked byte clocked out to parallel-port device. Sibling IN-direction branch (:751-755) correctly uses fallback of 1 confirming 2 is defect. OUT path reads in 2-byte microsequence pairs. Attacker: malicious parallel-port ZIP/Matchmaker device returns 0x88 status forcing OUT branch with odd dxfer_len (INQUIRY allocation length 255). Impact: 1 byte adjacent kernel heap leaked per CCB. Physical access required.