VPD error-cleanup loops use NULL sentinel without guaranteed terminator after krealloc shrink - OOB read and kfree of garbage pointers

Summary

In pci_read_vpd() success-path krealloc at :1225 (vpd_ros) and :1280 (vpd_w) SHRINK arrays to exactly off entries. Error-cleanup loops at :1300 and :1315 iterate using NULL value pointer as sole termination sentinel but shrink removes zeroed padding beyond populated entries. If krealloc allocates new smaller block loop reads past allocation and for each non-NULL garbage value pointer calls kfree corrupting kernel heap. After shrink there are exactly off entries ALL with non-NULL value pointers no trailing sentinel entry with value==NULL. Malicious PCIe device with VPD capability serves one well-formed VPD-R item (triggers shrink) then second item with wrong checksum triggers cksumvalid=0 cleanup.