unsafe nvram access in prefcompat.c

[noceb0]

prefcompat uses a hardcoded preferences offset, which could damage devices with 512k nvram

we should be reading the pref offset from the firmware header