CVE-2026-98204: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

In the Linux kernel, the following vulnerability has been resolved:

Input: rmismbus - fix out-of-bounds read in rmismbwriteblock()

When chunking writes into SMBus blocks in rmismbwriteblock(), the loop calculates blocklen using the original total length (len) instead of the remaining length (curlen).

If len is greater than 32 bytes (SMBMAXCOUNT), blocklen remains 32 for every iteration, even on the final partial chunk where fewer than 32 bytes remain. This causes smbblockwrite() to read 32 bytes from the advanced data buffer pointer, reading past the end of the input buffer.

Fix this by calculating blocklen using curlen and advancing the buffer and address pointers by blocklen.