Signed/unsigned promotion in tpm_tis12_write makes a zero-length write read past the stack buffer into the TPM

Summary

tpm_tis12_write uses size_t cnt against int len-1 in loop guard. When called with len==0 (reachable via write(fd buf 0) on /dev/tpm) len-1 becomes -1 promoted to SIZE_MAX in mixed signed/unsigned comparison loop runs unbounded. Inner for-loop walks p past callers 1024-byte stack buffer buf[TPM_BUFSIZ] reading kernel stack bytes one at a time writing them to TPM DATA register until TPM drops TPM_STS_DATA_EXPECT. After 1024 iterations p leaves buffer dereferencing adjacent kernel stack. bus_space_write_1 faults kernel panics. In vTPM scenario leaked kernel-stack bytes received outside guest (guest-to-hypervisor info leak). /dev/tpm 0600 root:wheel.