usb: the controller says how many device slots it has

max_devices was 8, with the comment "QEMU presents a handful; a fuller
machine would grow this" — a number chosen against the test rig, waiting for
a real machine, which is the pattern docs/bounds-track-plan.md exists to
stop.

The driver already knew the true figure. It reads HCSPARAMS1.MaxSlots at
bring-up and writes it straight into op_config, so every slot the controller
offers has always been *enabled*; only the array tracking them was 8. QEMU's
xHCI reports 64, so seven eighths of the controller was live and invisible,
and the ninth device — a keyboard, mouse, webcam, headset, hub and two
sticks reach that without trying — disappeared on a hub-attached path that
logs nothing at all.

The array becomes a slice allocated from max_slots at bring-up. A controller
claiming zero slots cannot address anything, so that is now a dead
controller rather than an empty allocation failing mysteriously later. The
Device Context Base Address Array is a page, 511 usable entries, so it
already covered the 255-slot maximum.

The bring-up line reports both numbers, and usb-hid asserts they are equal
with a backreference rather than a magic number, so the test cannot drift
from the hardware. Pinning tracking back to 8 fails it: "64 slots,
tracking 8".

Suite 115/115.

test/qemu_test.py

@@ -625,11 +625,18 @@ CASES = [
     # manager spawn the USB keyboard driver, which opens its device over the
     # transfer protocol, asks for boot protocol, subscribes to its interrupt
     # endpoint, and comes up — proof the class-driver <-> controller path works.
+    #
+    # It also pins the slot count to the hardware's answer. The backreference is the
+    # assertion: the driver must track exactly as many device slots as the controller
+    # reports in HCSPARAMS1.MaxSlots. It tracked a fixed 8 while QEMU's xHCI reports
+    # 64, so seven eighths of the controller was invisible and a device behind a hub
+    # past the eighth vanished without a log line. \1 fails the moment they diverge.
     {"name": "usb-hid",
      "smp":    4,
      "timeout": 150,
      # usb-kbd/usb-mouse ride the default boot xHCI bus (see qemu_args).
-     "expect": r"(?=[\s\S]*usb-hid-keyboard: ok)(?=[\s\S]*usb-hid-mouse: ok)",
+     "expect": r"(?=[\s\S]*usb-xhci-bus: controller running \((\d+) slots, tracking \1,)"
+               r"(?=[\s\S]*usb-hid-keyboard: ok)(?=[\s\S]*usb-hid-mouse: ok)",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
     # Keyboard echo: inject a known phrase via QMP send-key; the usb-hid-keyboard
     # driver decodes it and echoes each character to the log (the simple