Data loss via stale xHCI event matching

Race condition in Linux kernel 6.10 allows local users to cause data loss or a buffer use-after-free through xHCI event handling. The xHCI ring handler can match a delayed underrun or overrun event to a newly queued transfer descriptor at the old enqueue position and return that descriptor prematurely. The race requires an xHCI controller, isochronous transfers, a missed-service error, and delayed interrupt handling; consequences are limited to transfer data loss or controller access to a freed buffer.