Kernel memory corruption via dangling input handler

Use-after-free in Linux kernel 6.15 through 6.15.5 allows local users to corrupt kernel memory during HID device registration. The appletb_kbd_probe function registers a device-managed handler but fails to unregister it when a later probe step fails, leaving input_handler_list to retain freed memory that input_attach_handler later dereferences. The same flaw affects 6.16-rc1 through 6.16-rc4; reaching it requires local access, a probe failure after handler registration, and later registration of another input device.