> If the driver author only looks at __i2_transfer => master_xfer invocations
> as employed by i2c_smbus_xfer_emulated, and PEC isn’t used either, then that
> code path let’s you get away with pretty much any msgs[i].len you come up with.

Which explains the patch we are discussing here. I wanted to have a
simple way to trigger I2C_M_RECV_LEN from userspace.

I am thinking of adding a check to this patch: complain if msg->len is
not what we expect and tell people they should report it.