UAC2.0 Mixer Unit verifier reads d1->bNrChannels one byte past the validated length

Summary

In uaudio20_mixer_verify_desc UAC2 MIXER case reads d1->bNrChannels (first byte of mixer_unit_1 at offset 5+bNrInPins) after only checking bLength>=5+bNrInPins. When crafted device sets bLength exactly equal to 5+bNrInPins (descriptor contains header+source IDs but no mixer_unit_1) read of d1->bNrChannels lands at offset bLength one byte out of bounds. Bogus value makes final bLength<len check fail descriptor rejected but transient 1-byte OOB read already occurred. Impact: single-byte OOB read during verification panic at page boundary no data exfiltrated.