Heap-use-after-free through ehci_flush_qh