Kernel crash via unchecked matrix frame length

Buffer overflow in OpenRazer 3.3.0 and earlier allows local users to crash the kernel through the razeraccessory matrix_custom_frame interface. The matrix custom-frame functions derive row_length from attacker-controlled column bounds and copy that many RGB bytes into fixed-size report arguments without capping the length. Exploitation requires local write access to the driver attribute; the disclosed outcome is a kernel crash, while privilege escalation was not demonstrated under fortified memcpy bounds checking.