rmi4 F55 Electrode OOB

Vulnerability analysis

During initialization of the touch sensor, a copy-paste error caused the transmitter electrode count to be set to the receiver electrode count instead of its own correct value. This wrong count was then used by the diagnostics reporting function to calculate buffer sizes. On hardware where the receiver count exceeds the transmitter count, the diagnostics function would calculate a buffer size larger than the actual data available, leading to out-of-bounds memory access when reading diagnostic reports. The fix corrects these assignments so the proper transmitter count is used throughout. The vulnerable code runs on systems with Synaptics RMI4 touch devices; a local user can trigger diagnostics reads through the input subsystem without needing elevated privileges beyond access to the device.