Unbounded loop in num_compl_pkts causes kernel panic from malformed Number Of Completed Packets event

Summary

num_compl_pkts loops ep->num_con_handles times attacker-controlled u_int8_t reading 4 bytes per iteration via m_copydata with no check mbuf contains enough data. Malformed Number_Of_Completed_Packets event with num_con_handles larger than payload drives m_copydata past mbuf chain panicking kernel. Event can be emitted by controller at any time not only during active connections. Malicious USB BT dongle or compromised firmware.