Heap-use-after-free in usb_packet_unmap through xhci