Uninitialized UINT32 arg consumed by SET after failed HCI GET in hci_key_action

Summary

hci_key_action L474 UINT32 arg uninitialized. Each case (FN_F6/F7/F5/F8/ESC) calls hci_lcd_brightness/hci_video_output/hci_lcd_backlight/hci_force_fan(... HCI_GET,&arg) without checking return value. If HCI GET fails (hci_call non-zero ret) *arg untouched retains uninitialized stack. Subsequent arithmetic (arg--/arg++/(arg+1)%7) and HCI SET pass garbage. SET handlers bounds-check (*brightness>HCI_LCD_BRIGHTNESS_MAX return EINVAL) so most garbage rejected but garbage 1..7 brightness/1..7 video_output/0..1 backlight/fan written to HW verbatim. Reachable only from ACPI notify path (Fn key press) + transient GET failure. No memory corruption/escalation. Fix: initialize arg=0 check GET return before use.