Off-by-one NUL write past bt->model[5] in Inquire-Model parsing

Summary

Inquire-Model copy loop iterates i over full sizeof(model_data.ascii_model)(5 bytes) only breaks on space then writes bt->model[i]=NUL. bt->model is char[5] last field of struct bt_softc so when adapter returns 5 bytes with no 0x20 (including documented case 5th byte 0x00 not space) loop exits i==5 terminator write lands at bt->model[5] one byte past array/past end of softc. model_data.ascii_model 5 bytes bt->model 5 bytes no room for terminator. model final field of bt_softc overflow byte lands past softc allocation.