Missing arglen validation in NGM_SOURCE_GET_COUNTER allows uninitialized heap read

Summary

NGM_SOURCE_GET_COUNTER handler reads *(uint8_t*)msg->data without checking msg->header.arglen>=1. Every other data-reading command validates arglen. Message with arglen==0 reads uninitialized byte from heap allocation made by ngc_send kmalloc without M_ZERO. Byte used as array index 0..3 selects counter slot. NOTE: dead code does not compile not in build.