RT5592 TXWI extension: usbd_copy_in reads sizeof(data->desc)+4 bytes from data->desc, a 4-byte out-of-bounds read of desc/ridx/padding into the USB transfer buffer

Summary

mac_ver==0x5592 size math reads 4B past desc (ridx + 3B uninit padding; last array element stays inside the softc) - bytes travel only to the device. Correctness nit; extend-desc-or-append-zeroed fix.