System crash via malformed HID report handling

Type confusion in the Linux kernel HID subsystem allows local users with physical USB access to crash the system using a crafted device. hid_validate_values() and bigben_probe() call list_entry() on empty report lists, producing fake hid_report pointers; the Betop path also accepts one field with four values although playback dereferences a third field. A malicious HID descriptor is required; researchers later reported that the current structure layout makes the type-confusion paths nonexploitable, while the separate Betop mismatch reaches a null-pointer dereference.