Uninitialized kernel stack read via short/malformed CH341 control responses

Summary

uchcom_read_reg() and uchcom_get_version() declare 8-byte stack buffer without initializing issue vendor control-IN request with USB_SHORT_XFER_OK then unconditionally consume buf[0]/buf[1] as register values without checking how many bytes device returned or whether transfer errored. usbd_do_request_flags only copies received byte count so short/zero-length completion leaves buf[temp..7] untouched. Tainted bytes reach sc->sc_msr returned to userspace via TIOCMGET modem-status bits and printed verbatim to kernel log when USB_DEBUG compiled in. uchcom_ctrl_read discards usb_error_t return. Malicious CH341 device returning short/zero-byte response leaks up to 4 bits kernel stack per TIOCMGET poll + 2 raw bytes to dmesg.