Package helpers index Elements[idx] with no bounds check; the apparent NULL guard is dead code (heap OOB read / info leak)

Summary

acpi_PkgInt acpi_PkgStr acpi_PkgGas acpi_PkgRawGas dereference res->Package.Elements[idx] without ever checking 0<=idx<res->Package.Count. Each then guards with if(obj==NULL...) but obj obtained via address-of operator &res->Package.Elements[idx] which can never be NULL (for idx>=0 it is base+idx*sizeof for idx<0 wild non-NULL pointer) so guard is dead protects nothing. Any caller omitting ACPI_PKG_VALID or passing negative/over-large idx performs unbounded heap OOB read on Elements array reading obj->Type and (depending on garbage Type) Integer.Value String.Pointer+Length Buffer.Pointer+Length yielding per-call kernel-heap info leak into caller buffers (battery strings video levels) or kernel panic. All 36 in-tree callers pre-validate via ACPI_PKG_VALID so not firmware-triggerable today without concurrent driver bug.