pnp_check_quirks PNP_QUIRK_EXTRA_IO writes ic_port[] past ISA_NPORT without bounds check

Summary

pnp_check_quirks PNP_QUIRK_EXTRA_IO unconditionally increments config->ic_nport and writes config->ic_port[ic_nport-1] without verifying room in ic_port[ISA_NPORT] array. ISA_NPORT=50. Card spoofing SoundBlaster vendor ID with 50 IO_RANGE descriptors drives ic_nport to limit; quirk writes ic_port[50]/[51] aliasing ic_irqmask/ic_drqmask/ic_nmem inside same struct isa_config corrupting IRQ/DMA/memory programming. Parser itself guards before incrementing but pnp_check_quirks called AFTER ic_nport++ so can exceed. OOB stays inside kmallocd isa_config not heap corruption but causes wrong IRQ programming (DoS).