Kernel memory corruption via stale probe timer

Use-after-free in Linux 6.15 through 6.15.5 and 6.16-rc1 through 6.16-rc4 allows local users to corrupt kernel memory. The appletb_kbd_probe function arms inactivity_timer but does not disarm it when a later probe step fails, so the callback writes through a freed appletb_kbd structure after 60 seconds. The path requires discovery of an appletb_backlight device followed by probe failure; the documented consequence is a delayed write to freed kernel memory.