Ignored acpi_PkgInt32 return values leak uninitialized kernel stack via sysctl read

Summary

hci_call() discards return value of acpi_PkgInt32() at :442 and :445. If HCI/GHCI AML returns package whose element[0] is Integer(0)=HCI_SUCCESS but element[2] not ACPI_TYPE_INTEGER (Buffer/String faulty/missing) then status set to 0 success while *arg never written. Caller acpi_toshiba_sysctl() passes uninitialized stack UINT32 arg (:292) to sysctl_handle_int() (:307) which copies 4 bytes uninitialized kernel stack to any unprivileged reader (SYSCTL_OUT). Independently :442 reads ret uninitialized when element[0] non-integer before if(ret==HCI_SUCCESS) test. sysctls CTLFLAG_ANYBODY any local user can read. Leak materializes when firmware GHCI returns non-integer element[2] for GET while HCI_SUCCESS in element[0] - faulty/attacker-supplied ACPI tables.