Summary

acpi_battery_clean_str L321-334: for(i=0;i<len&&*str!=0;i++,str++) increments str to str+len when no NUL in len bytes. Post-loop if(i==len)*str=0 writes NUL at str+len one byte past callers buffer. For oeminfo (last field struct acpi_bif) writes past struct past union acpi_battery_ioctl_arg past kmalloc ioctl buffer. Reachable via ACPIIO_BATT_GET_BIF ioctl when SMBus battery returns 32-byte string field without NUL: acpi_smbus_read_multi_1 acpi_smbat.c:320 val=(BCNT&0x1f)+1 can be exactly 32 writes all 32 bytes no NUL; acpi_smbat_get_bif memcpy L488; acpi_battery_clean_str called L408-415. Control-method battery safe (acpi_PkgStr forces NUL within 32). Local unpriv user /dev/acpi. kmalloc(164) slab rounds to 192/256 padding benign in practice but genuine memory-safety defect. Fix: write NUL at str[len-1] when i==len (truncate last char).