usbd_req_get_ss_hub_descriptor() length formula overflows struct usb_hub_ss_descriptor by one byte for nports >= 249 — latent kernel stack OOB write with device-controlled byte

Summary

len = 10+1+ceil(nports/8) reaches 43 for nports in [249,255] - one byte past the 42-byte destination, and exact-length is enforced so a device answering with 43 bytes writes its final byte past the caller's struct. All in-tree callers clamp nports (<=15 physical SS, <=127 synthetic root) so unreachable today; exported KPI, one-future-caller-from-live. Self-consistent-formula + cap fix.