Off-by-one NUL heap write in acpi_battery_clean_str past the _BIF oeminfo field

Summary

acpi_battery_clean_str() NUL-terminates a full buffer by writing to *str AFTER loop has already advanced str one byte past end. For i==len after post-increment str points to start+len - one byte PAST end of len-byte buffer - so *str=NUL is OOB write to index len. For oeminfo (last member of struct acpi_bif) with 32-byte non-NUL OEM string writes NUL to offset 164 = one byte past 164-byte union acpi_battery_ioctl_arg. Ioctl dispatcher heap-allocates exactly IOCPARM_LEN=164 bytes. OOB fires when _BIF returns oeminfo with no embedded NUL in 32 bytes (common on physical HW deterministic under QEMU with crafted SSDT). zoneindex rounds 164->176 so NUL lands in per-chunk padding no metadata corruption on default allocator but latent memory-safety bug. Reachable by any unprivileged local user via /dev/acpi (0644) hook dispatch before FWRITE gate.