Partial MMIO key read returns success without zeroing unfilled buffer tail enabling uninitialized-stack leak through sysctl

Summary

apple_smc_mmio_key_read() reads only min(HW-reported rlen len) bytes into callers buffer but returns success (0) without zeroing buf[rlen..len-1]. ISA backend always fills exactly len bytes so callers assume full buffer initialized. Several sysctl handlers (apple_smc_clkt_sysctl apple_smc_msps_sysctl apple_smc_mbp_sysctl_light_left_10byte) do not memset stack buffers and decode/return all len bytes to userspace leaking uninitialized kernel stack if SMC firmware reports rlen<len. Precondition: SMC firmware reports shorter data length (not attacker-triggerable on stock hardware). Defense-in-depth.