# DF-2375 - acpi_battery_clean_str off-by-one: REFUTED at runtime

## Why the OOB cannot fire through the only in-tree path
1. bif.oeminfo is filled ONLY by acpi_PkgStr(..., 32) in acpi_cmbat_get_bif.
2. acpi_PkgStr bzero()s dst then rejects strings of length >= 32 (E2BIG,
   acpi_package.c:84-86) - a 32-char oeminfo NEVER lands in bif.oeminfo.
3. The ioctl path bzero()s the 164-byte kernel buffer before filling, so
   attacker-prefilled user bytes cannot survive either.
=> bif.oeminfo always contains a NUL in bytes 0..31; the `if (i == len)
   *str = 0;` branch is never taken.

## Empirical (ACHARNESS boot + ssdt_acsim BAT0 with 32-char oeminfo)
- bif_oob 0 -> oeminfo[32]='' (empty: E2BIG path)
- poison:164:6 + ioctl + check:164:164 -> no OOB byte-164 write observed

The clean_str off-by-one itself is real as isolated code (latent hardening
issue); fix.diff terminates the LAST byte instead of one past the buffer.