tpm_legacy_read unconditionally writes through a NULL count pointer panicking on every multi-chunk read of a legacy TPM

Summary

tpmread calls backend sc_read with count==NULL when fetching response body chunks (:1237). Legacy backend tpm_legacy_read ends with unguarded *count=cnt (:1092) unlike tpm_tis12_read which guards with if(count) (:800). Guaranteed kernel NULL-pointer dereference panic on any /dev/tpm read whose TPM response longer than 10-byte header on systems whose TPM attaches via legacy (Atmel) interface. tpmread header read uses &cnt body loop passes NULL. On legacy-attached device first response body read dereferences NULL kernel faults.