uint16_t to uint8_t truncation of nfmt/nfrm/nitv causes NULL-deref panic on device attach

Summary

uvc_drv_init_data_fmt counts formats/frames/intervals into uint16_t locals but stores into uint8_t struct fields (data->nfmt/nfrm/nitv). With exactly 256 format descriptors data->nfmt silently becomes 0. Buffer sizing uses full uint16_t values (allocation correct) but recorded counts wrong. uvc_drv_init_cur_fmt_frm format-search loop skipped when nfmt==0 local fmt pointer stays NULL fmt->nfrm dereferences NULL kernel panic on device attach. 256 VS_FORMAT_* descriptors each 27 bytes total 6912 bytes fits in 65535 config descriptor. Deterministic local DoS via USB device no user interaction beyond plug-in.