Fix NULL key handling in jbsettings_get

[clxxrlove]

This brings over the NULL-key validation from
opa334/Dopamine@af3ffd8.

JBS_SYSTEMWIDE_JBSETTINGS_GET decodes key with
xpc_dictionary_get_string(), which returns NULL when the field is missing
or is not a string. The decoded value is passed to jbsettings_get(), where it
is used by strcmp() without validation.

Return -1 for a NULL key, matching the existing behavior for unknown keys.
Valid requests are unchanged.

[roothider]

This appears to be a feature of Dopamine 3; can it actually be triggered in Dopamine 2-roothide?

[clxxrlove]

@roothider Thanks for the quick review!

The upstream fix is on Dopamine 3, but the affected handler predates it and is also present in this RootHide 2.x branch. JBS_SYSTEMWIDE_JBSETTINGS_GET is registered in jbdomain_systemwide.c, and jbserver_xpc_send(..., NULL) creates a structurally valid request containing only the domain and action. The generic decoder then passes a NULL key to jbsettings_get().

RootHide blocks blacklisted callers before dispatch, so this path is not reachable from every application. It can still be reached by a non-blacklisted process. The RootHide implementation also matches the upstream pre-fix version byte-for-byte.

[roothider]

merged, thanks~