Multicast filter buffer allocated before device descriptor is fetched -> write through ZERO_LENGTH_PTR in kue_setmulti

Summary

kue_attach() allocates sc->sc_mcfilters using KUE_MCFILTCNT(sc) which reads sc->sc_desc.kue_mcastfilt. But descriptor only fetched later asynchronously in kue_attach_post() (queued by uether_ifattach()). At allocation time newbus-zero-initialized softc yields KUE_MCFILTCNT(sc)==0 so kmalloc(0) returns ZERO_LENGTH_PTR=((void*)-8). Non-NULL check at :490 does NOT catch. Later kue_setmulti() executes memcpy(KUE_MCFILT(sc i) LLADDR ETHER_ADDR_LEN). With sc->sc_mcfilters==(void*)-8 first write targets 0xFFFFFFFFFFFFFFF8 unmapped top-of-space guard word -> faults. Malicious KL5KUSB101B adapter controlling 16-byte GET_ETHER_DESCRIPTOR reply sets kue_mcastfilt!=0. Impact: deterministic kernel page-fault panic local/physical DoS via untrusted USB adapter. kfree(ZERO_LENGTH_PTR) no-op so detach safe.