Missing Buffer.Length check in acpi_hp_exec_wmi_command (heap OOB read of result[1]/result[2])

Summary

acpi_hp_exec_wmi_command validates ACPI reply is ACPI_TYPE_BUFFER but never validates obj->Buffer.Length before indexing as UINT32 array reading result[1] (offset 4) and result[2] (offset 8). Short/zero-length buffer from BIOS causes OOB heap read up to 12 bytes. ACPI_ALLOCATE_BUFFER lets ACPICA size buffer to whatever BIOS returned. Triggered indirectly via every read of dev.acpi_hp.0.* sysctls wrapping WMI command and via acpi_hp_evaluate_auto_on_off on every ACPI wireless event. Firmware-gated (conformant HP BIOS returns 12 bytes) primarily robustness/defense-in-depth.