cxm_dec_fw: decoder firmware download loop bounded by hardcoded CXM_FW_SIZE (256 KiB), not the actual object size — latent kernel-rodata OOB read if an under-length firmware blob is compiled in

Summary

4-byte NOFW stub, unsized extern (cxm.h:308); the sole consumer copies a hardcoded 256KiB from the array (cxm.c:687-689) with no size validation. Stock stub = dead code (NOFW guard -> ENXIO, no /dev/cxmN); a builder dropping in an under-length real blob gets adjacent rodata OOB-read and DMA'd into card SDRAM (no read-back path to userspace). Build-time hazard only. Export-the-size + refuse-wrong-size fix; twin DF-5238.