acpi_wmi: _WDG result consumed unvalidated — NULL-deref boot panic on missing Return; ACPI_OBJECT union type-confusion memcpy on non-Buffer _WDG return

Summary

read_wdg_blocks evaluates _WDG and treats out.Pointer as a Buffer with no NULL/Type validation: a _WDG without Return yields AE_OK with NULL Pointer (ACPICA contract) - boot-time NULL-deref panic; an Integer/String/Package return union-confuses Length/Pointer, feeding kmalloc+memcpy with firmware-chosen length and semi-chosen source, whose contents are installed as GUID entries and printed to the world-readable /dev/wmistat. Firmware-gated (ACPI table control), inherited from FreeBSD (their _BMOF path has the fix pattern). Validate-before-use fix.