DF-4487 — uninitialized vo_sysctl_tree when the global video sysctl tree is absent

Root cause (code-certain; trigger requires SYSCTL_ADD_NODE failure / OOM at attach): - sys/dev/acpica/acpi_video/acpi_video.c:513 — vo = kmalloc(sizeof(*vo), M_ACPIVIDEO, M_NOWAIT); — NOT zeroed (no M_ZERO). - :514-522 initialize the scalar fields, but vo->vo_sysctl_tree is NOT in that list. - :535-539 vo->vo_sysctl_tree is assigned ONLY inside if (acpi_video_sysctl_tree != NULL). - :540 if (vo->vo_sysctl_tree != NULL) — reads the uninitialized field. When acpi_video_sysctl_tree is NULL (SYSCTL_ADD_NODE failed at attach under memory pressure, acpi_video.c:254-259) or MOD_UNLOAD set it to NULL (:204-205) while outputs still exist, the garbage heap value is treated as a struct sysctl_oid *: - SYSCTL_ADD_PROC(..., SYSCTL_CHILDREN(vo->vo_sysctl_tree), ...) ×5 (:541-572) — dereferences the garbage pointer (arbitrary kernel memory read/crash). - acpi_video_vo_destroy() (:623-626) re-checks the same garbage field and may run sysctl_ctx_free() on the wrong condition.

Why "untested": reproducing requires forcing SYSCTL_ADD_NODE failure (kernel memory exhaustion at first attach) — not deterministic on the audit guest. The uninitialized-read itself is evident from the code (kmalloc without M_ZERO + conditionally-assigned field + unconditional read).

Fix: use M_NOWAIT | M_ZERO in the kmalloc (or explicitly set vo->vo_sysctl_tree = NULL; in the :514-522 init block).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)