SESIOC_GETOBJMAP leaks 2 bytes of uninitialized kernel stack per object via ses_object struct padding

Summary

In SESIOC_GETOBJMAP handler sesioctl declares local ses_object obj and populates only three named fields (obj_id subencid object_type) before copyout(&obj uobj sizeof(ses_object)). ses_object has 4-byte alignment sizeof==8 leaving 2 bytes of tail padding (offsets 6-7) never written. copyout copies full 8 bytes leaking 2 indeterminate kernel-stack bytes to userspace per iteration. Same 2 stack bytes leaked ses_nobjects times per call. Already tracked as DF-1013 pattern variant - sesopen gates SYSCAP_RESTRICTEDROOT so attacker must be root-equivalent. Impact: small kernel-stack info leak KASLR bypass building block. [VERIFIED pass2: reproduced - GETOBJMAP returns ff ff tail padding for all 24 objects matching primer vs 00 00 unprimed; 2 uninit stack bytes per object to userland; bzero fix-validated]