Kernel out-of-bounds read via unterminated cpulist

An out-of-bounds read in the osnoise tracer in Linux 6.16 allows local users to read beyond a kernel write buffer. osnoise_cpus_write() passes the write buffer to bitmap_parselist() without appending the NUL or newline terminator required by _parse_integer_limit(). Reaching the flaw requires write access to the osnoise debugfs cpus file; the published reproducer runs as UID 0, and no broader consequence than the detected one-byte over-read is documented.