SMBus block write transmits the command byte where the byte-count belongs — every Block Write is malformed on the wire

Summary

The count-issuing block sends '(u_char)cmd' - already transmitted by the preceding command block - instead of wcount: every block write puts CMD,CMD,DATA... on the bus with the real length never transmitted (SMBus 2.0 Block Write = ADDR,CMD,BYTECNT,DATA). Reached via ig4iic_smb_bwrite and the /dev/smbN SMB_BWRITE ioctl. Every ig4 block-write consumer silently corrupts; for the IPMI SSIF lineage every BMC-bound command would be malformed while the driver returns success. Wire-level source-proof (no ig4 model in QEMU - pm SMBus is ichsmb). Send-wcount fix.