CVE-2026-74339: ALSA: seq: Clear variable event pointer on read

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Clear variable event pointer on read

sndseqread() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr points at the first extension cell.

The read side strips SNDRVSEQEXT bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header.

Clear the temporary header pointer before copytouser(). The original queued event remains unchanged and is still passed to sndseqexpandvarevent(), so payload expansion keeps using the internal chain.