Unchecked SINF package index yields heap out-of-bounds read for short/malformed firmware packages

Summary

acpi_panasonic_sinf() indexes res->Package.Elements[index] without verifying index<res->Package.Count. Driver passes fixed indices up to HKEY_REG_SOUND_MUTE(0x08) assuming firmware SINF package always contains at least 9 elements. Buggy/hostile ACPI SINF method returning shorter package causes Elements[index] to read past end of ACPICA-allocated package buffer. Value read assigned to UINT64 ret propagated back through hkey_*_brightness -> acpi_panasonic_sysctl -> sysctl_handle_int to userspace via CTLFLAG_ANYBODY sysctl. Requires firmware defect or crafted ACPI table (VM with hand-built DSDT). Primarily robustness/firmware-trust hardening.