Kernel heap corruption via undersized clock allocation

Memory corruption in the MediaTek CMDQ mailbox driver in Linux 6.11 through 6.11.10 and 6.12 through 6.12.1 allows local users to crash the kernel. cmdq_get_clocks allocates each clock entry using the size of a pointer instead of struct clk_bulk_data, then writes identifiers and clock pointers beyond the allocation and later dereferences out-of-bounds entries. The defect is reached when the driver binds on affected MediaTek SoCs, where probing occurs automatically and can corrupt adjacent kernel objects without user interaction.