usb: a configuration block is as long as the device says it is

The driver read the first 512 bytes of a configuration block into a fixed
buffer and parsed those. The block's length is the device's own choice
(wTotalLength, a u16), so anything larger was silently cut: interfaces past
the cut did not exist as far as the host was concerned, while the
SET_CONFIGURATION that follows still configured the device for all of them.
A headset is 500-900 bytes, a UVC webcam 1-3 KB, a multifunction printer
600+.

Now allocated at the declared length, so the ceiling is the field's u16 —
the specification's number rather than one of ours. A block shorter than its
own 9-byte header is refused rather than trusted.

The bring-up line reports the declared length and the bytes actually read,
so a truncation can never again be invisible, and usb-large-descriptor
asserts they match with a backreference.

That case has an honest limit, recorded in its comment: QEMU cannot produce
a block over 512 bytes. The boot keyboard, mouse and stick are 34-44, and
the largest device available is usb-audio in multi-channel mode at 211 —
which is exactly why the suite never caught this, and why it cannot now
reproduce the original trigger. What it does catch is the class: any clamp
below the attached device's block fails it, verified by pinning the buffer
to 128 and watching "config block 211 bytes, read 128" turn the case red.

Suite 115 -> 116.

tools/bounds-allowlist.txt

@@ -76,7 +76,6 @@ system/drivers/usb-xhci-bus/usb-xhci-bus.zig:maker_buffer
 system/drivers/usb-xhci-bus/usb-xhci-bus.zig:prev_connected
 system/drivers/usb-xhci-bus/usb-xhci-bus.zig:product_buffer
 system/drivers/usb-xhci-bus/usb-xhci-bus.zig:product_buffer
-system/drivers/usb-xhci-bus/usb-xhci-library.zig:blob
 system/drivers/usb-xhci-bus/usb-xhci-library.zig:buffer
 system/drivers/usb-xhci-bus/usb-xhci-library.zig:bytes
 system/drivers/usb-xhci-bus/usb-xhci-library.zig:data