sub_info->uvc_info stores a dangling pointer to the initializer's dead stack frame (persisted in the heap control graph)

Summary

build_mapping stores &tmp_info (a stack local of initialize_control) into heap sub_infos that outlive the frame; the wholesale struct copy does not fix up the back-pointer. Never dereferenced today (grep-verified) - latent landmine toward a stack-content disclosure if any future path follows it (the Linux driver does for get/set). Re-point-after-copy fix.