uvc_buf_queue_req_bufs signed count handling is undefined behavior: count >= 0x80000000 makes int num negative, skipping the clamp and the allocation loop and reading an uninitialized mem (currently compiled to ENOMEM by the shipping gcc - fragile across toolchains)

Summary

num is int assigned from uint32 count: negative num skips the signed clamp and the alloc loop leaving uninitialized mem, and buf_count=num sign-extends defeating every index check for arbitrary uint32 indices. Objdump + runtime prove the shipping gcc 8.3 folds the uninit read into deterministic ENOMEM (bq->mem stays NULL) - UB real, no exploit today. mem=NULL + unsigned-clamp fix (in the validated DF-5434 diff).