[root@devel3 root]# grep "#define _IOR" `locate ioctl.h`

/usr/include/asm/ioctl.h:#define _IOR(type,nr,size)     _IOC(_IOC_READ
+,(type),(nr),sizeof(size))
/usr/src/linux-2.4.18-3/include/asm-i386/ioctl.h:#define _IOR(type,nr,
+size)     _IOC(_IOC_READ,(type),(nr),sizeof(size))
/usr/src/linux-2.4.18-27.7.x/include/asm-i386/ioctl.h:#define _IOR(typ
+e,nr,size)        _IOC(_IOC_READ,(type),(nr),sizeof(size))
/usr/i386-glibc21-linux/include/asm/ioctl.h:#define _IOR(type,nr,size)
+  _IOC(_IOC_READ,(type),(nr),sizeof(size))
[root@devel3 root]#
[download]

So the third argument is supposed to be a u8 which has a sizeof 1. You are passing it 'int' which has a sizeof 4 (probably). s/int/char/ might possibly fix it.