NULL+1 pointer dereference in ppb_pnp_detect() via malformed PnP string from malicious peripheral

Summary

ppb_pnp_detect() parses IEEE 1284 PnP device ID from peripheral. At six call sites computes search_token(token UNKNOWN_LENGTH ":")+1 without checking for NULL return. If peripheral returns string with recognized field token (MFG MDL VER REV CLS CMD) without : separator search_token returns NULL yielding (char*)0x1 pointer immediately dereferenced by kprintf %s. Semicolon-to-NUL replacement at :236-237 fragments string so device returning MFG;PRINTER becomes MFG\0PRINTER with no : -> NULL+1. Malicious parallel port peripheral triggers automatic bus scan at boot. Impact: immediate kernel panic DoS.