Uninitialized kernel-stack info leak via fanid sysctl on MMIO/T2 backend

Summary

apple_smc_mb_sysctl_fanid() declares uint8_t buf[16] and asks apple_smc_fan_getstring() to read 16 bytes for F%dID key whose real payload is 8 bytes. On MMIO/T2 backend apple_smc_mmio_key_read() only fills min(reported_len requested_len) bytes leaving tail uninitialized. Port-IO backend always fills exactly len bytes so backends have incompatible fill contracts. desc=buf+4 handed to sysctl_handle_string() which strlen()s with no length bound. If 4-byte fan-name field not NUL-terminated strlen scans into uninitialized buf[8..15] and past buf[15] into adjacent kernel stack frame until NUL all bytes copied to userspace. Any unprivileged local user via sysctl dev.apple_smc.<unit>.fan.<n>.id. Precondition: MMIO/T2 backend active AND fan name field not NUL-terminated within 4 bytes.