Local kernel compromise via incorrect pointer arithmetic

Out-of-bounds access in the Linux kernel 6.14 through 6.16.4 allows local users to corrupt kernel memory by suspending an affected host. The thc_i2c_subip_regs_save() callback uses the address of the i2c_subip_regs pointer during repeated bulk reads, causing writes beyond its allocated array instead of directly indexing each element. An unprivileged user with an active local session can trigger suspend without root; on Intel THC I2C hardware, the write can crash the kernel or corrupt adjacent slab objects.