Missing large_len>0 guard in ANSI-string trim walks buf[] backwards (OOB stack read + NUL write + stack info-leak via device desc)

Summary

When parsing PNP_TAG_ID_ANSI large resource with declared length 0 trailing-space trim loop evaluates buf[large_len-1]=buf[-1] with no lower-bound check. One-byte OOB stack read unconditional; if that byte is 0x20 loop walks backwards then writes NUL at negative offset and leaves buf uninitialized. desc pointed at uninitialized buf then device_set_desc_copy does strlen+strcpy leaking uninitialized stack contents into device description visible via devinfo/dmesg. Sibling parser pnpparse.c:231 has correct guard while (len>0 && buf[len-1]<=32) but pnp.c never updated. Attacker controls PnP ISA card resource bytes during boot (malicious host in VM or malicious ISA card). Leaked stack bytes contain return addresses/pointers useful for KASLR defeat.