Kernel crash via over-reverted netfs write iterator

Out-of-bounds access in the Linux netfs write-retry path allows remote attackers controlling a 9p server to crash the kernel. netfs_retry_write_stream() resets a shortened subrequest iterator by the full length instead of subtracting transferred bytes, causing iov_iter_revert() to walk before valid storage. Reachability requires an existing privileged netfs mount and attacker-controlled short-write replies; the corrupted iterator can also expose kernel memory or corrupt page references.