Missing NUL-termination of PnP string enables OOB stack read in search_token()

Summary

ppb_pnp_detect() allocates 257-byte stack buffer str[PPB_PnP_STRING_SIZE+1] but ppb_1284_read_id only bzeros 256 bytes. The 257th byte uninitialized. If peripheral returns exactly 256 non-NUL bytes str[256] is uninitialized stack garbage and search_token UNKNOWN_LENGTH scan loop walks past str[255] into adjacent stack memory reading kernel stack contents (info leak of return addresses/pointers) and potentially crashing if walks into unmapped guard page. ppb_pnp_detect never executes str[len]=\0.