Heap OOB read via zero-element ACPI SIF package - no count check before o[0]

Summary

aibs_attach_sif() accesses o[0] (where o=bp->Package.Elements) without first verifying bp->Package.Count>=1. ACPICAs AcpiUtCopyIpackageToEpackage sets Package.Elements=Buffer+sizeof(ACPI_OBJECT) for zero-element package exactly past end of allocated buffer. o[0].Type read dereferences OOB pointer reading ~56 bytes past heap allocation. AcpiEvaluateObjectTyped only validates top-level Type==ACPI_TYPE_PACKAGE does not check element count so Package(0){} passes type check. Attacker: malicious ACPI table DSDT/SSDT with Method(VSIF) Return(Package(0){}). OOB read data used only for internal comparison not copied to userspace - worst case panic if crosses unmapped page unlikely in kernel heap.