Missing cst_cx_count==0 guard causes OOB heap read in set_lowest_oncpu and NULL-deref panic in idle

Summary

If ACPI _CST evaluates successfully but every C-state sub-package fails validation acpi_cst_cx_probe_cst returns 0 success with sc->cst_cx_count==0 and never falls back to FADT (use_fadt only switches on probe FAILURE). With count==0 acpi_cst_set_lowest_oncpu clamps any requested val to count-1==-1 and indexes sc->cst_cx_states[-1] reading 4 bytes kernel heap BEFORE softc allocation. Persists sc->cst_cx_lowest=-1 after which next acpi_cst_idle selects cst_cx_states[0] which is fully zeroed (type==0 enter==NULL) panics via KASSERT (INVARIANTS) or NULL-deref indirect call cx_next->enter (production). ACPI_PKG_VALID(top 2) only requires Count>=2 per-element loop continues on invalid sub-package without incrementing count. No post-loop check at least C1 installed.