Kernel heap address leak via incomplete pointer fix-up in ACPIIO_DO_MCALL Package results

Summary

acpi_call_fixup_pointers() only rewrites top-level String.Pointer/Buffer.Pointer when translating ACPICA result buffer for copyout. Does not handle ACPI_TYPE_PACKAGE nor recurse into nested Package elements. When ACPI method invoked via ACPIIO_DO_MCALL returns a Package (_BIF _BIX _PSL _PSS _CST _PCT) entire result buffer copyout()d with every internal pointer (Package.Elements nested Package.Elements nested String.Pointer nested Buffer.Pointer) left as raw kernel virtual addresses defeating KASLR/leaking kernel heap layout. ACPICA allocates single buffer whose internal pointers reference locations within same buffer. For Package with N elements user receives N+1 raw kernel heap addresses. Requires FWRITE on /dev/acpi (root) + debug.acpi.allow_method_calls=1 (boot-only loader tunable default 0).