Out-of-bounds access via inflated predicate parsing limit

Out-of-bounds access in Linux tracing allows local users to access memory beyond a filter program via crafted filter expressions. In kernel/trace/trace_events_filter.c, predicate_parse() includes two reserved terminal entries in its predicate limit, allowing parsing to exhaust the allocation when the initial count underestimates the parsed predicates. Access requires permission to write tracing filters; the disclosed consequence is out-of-bounds kernel memory access, with no demonstrated code-execution outcome.