arm_scmi PowerDomain OOB

Vulnerability analysis

The SCMI power protocol's domain name lookup function uses a caller-supplied domain number as a direct array index without checking it against the number of registered power domains. When the index exceeds the array bounds, the function reads memory beyond the allocation, which can either return leaked kernel heap data as a string or trigger a kernel panic by dereferencing unmapped memory. The fix adds a simple bounds check that returns a placeholder string for any domain number outside the valid range, matching the pattern already used in the SCMI reset protocol. This vulnerability is reachable only on ARM platforms that use the SCMI firmware interface for power domain management, and requires a local caller who can influence the domain number passed to the power protocol handler.