CVE-2026-98767: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

When dwc3checkeventbuf() reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 ("usb: dwc3: gadget: check that event count does not exceed event buffer length") returns IRQNONE without writing back GEVNTCOUNT. Since the DWC3 interrupt is level-triggered, the uncleared IRQ source keeps the line asserted, causing a tight IRQ storm that accumulates 99,900 unhandled interrupts and triggers spurious.c:184 BUG -> kernel panic.

The resulting call stack: reportbadirq+0xac/0xc8 noteinterrupt+0x340/0x468 handleirqevent+0xac/0xc0 handlefasteoiirq+0x120/0x228 gichandleirq+0x68/0x108 ... kernel BUG at kernel/irq/spurious.c:184

To reproduce, write a bogus value exceeding the event buffer length directly to the GEVNTCOUNT register:

devmem <DWC3BASE + 0xc40c> 4 0x1004

Write the bogus count back to GEVNTCOUNT to clear the IRQ source, consistent with the stale event clearing pattern in dwc3eventbufferssetup(), and schedule error recovery to reinitialize the controller.