Uninitialized kernel-stack bytes leaked to userspace via uep FIFO during short-transfer packet reassembly

Summary

In uep_intr_callback cross-transfer reassembly path computes res=pkt_len-sc->buf_len from previous transfer header bytes then does memcpy(sc->buf+sc->buf_len buf res) without checking res<=len where len is how many valid bytes current interrupt transfer actually delivered. When device sends short transfer (len<res) copy reads uninitialized kernel-stack bytes from local buf[17] deposits into sc->buf. For REPORT packets (byte0 0x80/0x81) uep_process_pkt() passes straight to uep_put_queue() which pushes 5 bytes including uninitialized ones into RX FIFO userspace reads from /dev/uepN. short_xfer_ok=1 permits 1-byte transfers making this fully reachable. 1-byte 0x80 first transfer sets buf_len=1 second 1-byte transfer res=4 copies 3 uninit bytes into sc->buf[2..4] leaked to userspace. [VERIFIED pass2: reproduced - 1-byte then 1-byte transfer makes memcpy sc buf plus 1 read 3 bytes the device never sent with poisoned stack readable from 0644 dev uepN by unpriv users; short-transfer stash fix-validated]