Unbounded idx extension loops in CISTPL_CFTABLE_ENTRY read past the declared tuple body

Summary

CISTPL_CFTABLE_ENTRY parser advances body index idx through several extension/subfield loops without comparing idx against tuple->length inside the loop. Power-parameter extension loop (:995-1003) and misc extension loop (:1243-1246) iterate solely on attacker-supplied byte contents. If bytes carry 0x80 extension bit idx walks past declared tuple body. pccard_tuple_read_* macros do no inherent bounds checking. If attribute memory past tuple body is all 0xFF (erased state) every read returns 0xFF 0x80 bit stays set idx advances until out-of-window access. Either kernel hang/spin (bridge wraps) or panic (leaves mapping). [VERIFIED pass2: reproduced - both CFTABLE_ENTRY extension loops walk past the tuple body and with erased attribute memory the scan never terminates, 4M-read budget exhausted; length-guard fix-validated]