ACPIIO_DO_MCALL leaks kernel heap pointers via PACKAGE results (incomplete pointer fixup)

Summary

acpi_call_fixup_pointers() at acpi.c:3380-3391 only switches on top-level p->Type for STRING/BUFFER, does NOT recurse into Package.Elements. For PACKAGE result: Elements pointer + nested String.Pointer/Buffer.Pointer are kernel addresses, copied verbatim to userspace by copyout at :3368. Requires /dev/acpi FWRITE (root) AND debug.acpi.allow_method_calls=1 (default off). Attacker evaluates any ACPI method returning Package (_PRW/_CST/_PSS) to learn ACPICA heap address -> KASLR bypass. Fix: reject Package results or recursively relocate all nested pointers.