CVE-2026-74683: Input: evdev - sanitize event type index when fetching event masks

In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - sanitize event type index when fetching event masks

The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt() and client evmasks array in evdevgetmask().

While the event type is architecturally bounded by EVCNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads.

Sanitize the event type index in evdevgetmaskcnt() branchlessly using arrayindexmasknospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds.

We do not need additional arrayindexnospec() calls in evdevgetmask() because evdevgetmaskcnt() speculatively forces the count (and resulting xfersize) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.