Kernel crash via incorrect PFN batch end index

NULL pointer dereference in Linux kernel 6.2 through 6.4.7 allows local users to crash the kernel through iommufd teardown operations. The batch_clear_carry logic leaves the PFN batch end index at zero after pushing a carry item, causing batch_unpin to dereference an uninitialized entry. Access to the iommufd ioctl path and the rare batch-carry teardown sequence is required; the reported consequence is a kernel oops without data disclosure or modification.