uaudio20_mixer_verify_desc FEATURE case under-validates bLength, allowing 1-3 byte OOB read in uaudio20_mixer_add_feature (defense-in-depth)

Summary

uaudio20_mixer_verify_desc at uaudio.c:4000 FEATURE case: len += sizeof(*u.fu)+1 = 6. Consumer uaudio20_mixer_add_feature at :3563 UGETDW(d->bmaControls[0]) reads 4 bytes at offset 5 -> requires bLength>=9. For bLength in {6,7,8}: verify passes, UGETDW reads 1-3 bytes past descriptor into config-desc heap buffer. Mitigating: nchan=(bLength-6)/4=0 -> function returns immediately via nchan==0 at :3572; OOB-read value only compared to 0, not stored. No observable effect today. Defense-in-depth: if future change moves nchan before UGETDW or uses mmask, becomes heap info-leak. Malicious USB audio v2 device triggers on plug-in. Fix: len += sizeof(*u.fu)+4 (bLength>=9).