NuttX kernel syscall dispatcher does not validate the syscall ID

### Location:

https://github.com/apache/incubator-nuttx/blob/master/arch/arm/src/armv7-m/arm_svcall.c#L81

### Impact:

In the NuttX kernel, syscall numbers are not properly validated, allowing an attacker in user space to index the syscall table out-of-bounds to invoke an arbitrary kernel function.

### Description:

In the NuttX kernel, the `dispatch_syscall` function is called when a user mode application executes a SWI instruction to perform a syscall.

The syscall dispatcher interprets `r0` as the syscall number, and then uses the syscall number to compute an offset into the kernel syscall lookup table, `g_stublookup`. The dispatcher will then branch to the function pointer that is located at the table offset.

However, there is no validation that `r0` is within the bounds of `g_stublookup`. If an attacker provides a value that is out-of-bounds of the look-up table, execution will branch to an arbitrary location in the kernel memory space. This would most likely allow a malicious user space application to execute arbitrary code in supervisor mode.

This attack presumes that an adversary has first compromised a user application and wishes to escalate privilege to kernel mode, so that they can more thoroughly compromise the device.

### Recommendation:

For the ARMv7-M platform, the `dispatch_syscall` function must validate `r0` against the size of the syscall table.

Although this finding affects the ARMv7-M platform, it is likely that other syscall dispatchers are similarly vulnerable, though NCC Group did not confirm this.