Kernel data disclosure via speculative syscall indexing

Speculative out-of-bounds access in the RISC-V Linux kernel allows local users to disclose kernel data through a cache side channel. The RISC-V trap handler bounds-checks a user-controlled syscall number but indexes the syscall table without clamping the value used during speculative execution. The gate is local low-privileged access on a vulnerable RISC-V system, and the established consequence is indirect disclosure rather than a direct write or service interruption.