pnp_parse_desc reads fixed descriptor offsets without validating declared length causing heap OOB reads up to 17 bytes

Summary

pnp_parse_desc() dispatches on resource tag and unconditionally dereferences fixed offsets inside descriptor body without checking declared length len is large enough to cover those offsets. Only bound checked upstream is len>=l where l is the declared length. A malicious/buggy ISA PnP card can supply descriptor with declared length 0 (or shorter than handler access width) forcing kernel to read 1..17 bytes past descriptor potentially past kmalloc buffer end. Examples: PNP_TAG_MEMORY32_RANGE reads I32(res+13) needs 17 bytes. PNP_TAG_COMPAT_DEVICE does bcopy(res &compat_id 4) needs 4. PNP_TAG_IO_RANGE reads res[6] needs 7. Resource bytes read verbatim from card hardware register. Impact: kernel heap OOB read up to 17 bytes. DoS if crosses page boundary into unmapped page or limited info leak into ISA resource fields.