DF-5604 leak capture (what device_printf(dev, "<%s>", temp_p) would print)

Raced reader (post-unlock strlen/copy, exactly device_set_desc_copy shape):

  strlen(scratch)          = 1023   (scratch boundary: 255 bytes)
  bytes past boundary      = 769
  desc[0..25]              = "\x8d-N-N-N-N-N-N-N-N-N-N-N-"
                             (raw device-supplied UTF-16 bytes 0x2D/0x4E
                              that overwrote the previous string)
  desc[255..290]           = "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
                             (0x5A markers standing in for the adjacent
                              kernel heap after struct usb_device's
                              scratch — in production: struct tail, then
                              neighboring slab contents, incl. pointers)

Control run (no concurrent writer):

  strlen(scratch) = 25, bytes past boundary = 0,
  desc = "Generic USB interface hub"

Identical across 4 raced runs (initial + 3 stress) — deterministic.