Fix xHCI heap corruption: allocate the Output Device Context full size at Address Device, never swap it (found at O-C)

xhci_cmd_address_device() sized the Output Device Context for Slot + EP0
(64 bytes); xhci_cmd_configure_endpoint() then allocated a bigger copy and
repointed DCBAA[slot_id]. The controller keeps the address it was given at
Address Device (QEMU caches it), so every bulk Endpoint Context was written
past the 64-byte block into the next kmalloc header -- on every USB
mass-storage attach, every ISA. After O-C's smoke campaign reshuffled the
heap, a kfree at thumbdrive unplug walked into it: #GP in coalesce_neighbors().

Found with temporary instrumentation (load base, code bytes at RIP, event
crumbs, a heap-list checker): the corrupt word was an EP Context (Bulk IN,
Running, MPS 1024) exactly DCI 3 x 32 bytes into the 64-byte context.

Now: XHCI_DEVICE_CTX_BYTES (32 contexts x 32 bytes) allocated once per
slot at Address Device, zeroed whole, never reallocated; Configure
Endpoint just fills it. Also ends the per-attach leak of the old context.

Verified: heap checker clean from boot; campaign -> O-A -> MINT -> unplug
-> re-attach passes with 0 exceptions; 3-ISA acceptance passes, parity and
dict_hash set unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

experiments/bare_metal/runs/doe-amd64-20260925-013706.csv

@@ -0,0 +1,9 @@
+vm_name,vm_id_hex,tick_number,elapsed_ns,tick_interval_ns,cache_hits_delta,bucket_hits_delta,word_executions_delta,hot_word_count,avg_word_heat_q48,window_width,actual_window_size,predicted_label_hits,jitter_bits,apic_ticks,time_trust_q48,variance_q48,vm_call_depth_max,hera_heat_q48,hermes_heat_q48,artemis_heat_q48,fleet_k_q48,fleet_conserved,switch_count_cumulative,switch_current_slot,switch_hera_readiness,switch_hermes_readiness,switch_artemis_readiness,switch_ticks_since
+Hera,0000000000000000-0000000000000000,76,760000,10000,0,0,256,61,35,4096,4096,0,0,20011,65533,3,1,65536,0,0,65536,1,0,2,0,0,0,9
+Hera,0000000000000000-0000000000000000,77,770000,10000,0,0,256,62,36,2048,2048,0,0,20012,65533,3,1,65536,0,0,65536,1,0,2,0,0,0,10
+Hera,0000000000000000-0000000000000000,78,780000,10000,0,0,256,62,37,2048,2048,0,0,20014,65533,3,1,65536,0,0,65536,1,0,2,0,0,0,11
+,3a3611885b52444c-91aeb2c971167037,1,10000,18446744073708781616,0,0,93,4,4,4096,0,0,4895412794951728771,20125,65533,3,0,65536,0,0,65536,1,0,2,0,0,0,11
+Hera,0000000000000000-0000000000000000,79,790000,780000,0,0,15572,67,38,1024,1024,0,4694861461728526336,20132,65533,3,1,65536,0,0,65536,1,0,2,0,0,0,12
+,edaab92527ee4080-ac1e0c431056e4e7,1,10000,18446744073708771616,0,0,98,7,8,4096,0,0,4895412794951728766,20253,65533,3,0,65536,0,0,65536,1,0,2,0,0,0,12
+Hera,0000000000000000-0000000000000000,80,800000,790000,0,0,15823,69,39,1024,1024,0,4694947361074446336,20260,65533,3,1,65536,0,0,65536,1,0,2,0,0,0,13
+Hera,0000000000000000-0000000000000000,81,810000,10000,0,0,256,71,40,512,512,0,0,20309,65533,3,1,65536,0,0,65536,1,0,2,0,0,0,14

experiments/bare_metal/runs/doe-amd64-20260925-043257.csv

@@ -0,0 +1,9 @@
+vm_name,vm_id_hex,tick_number,elapsed_ns,tick_interval_ns,cache_hits_delta,bucket_hits_delta,word_executions_delta,hot_word_count,avg_word_heat_q48,window_width,actual_window_size,predicted_label_hits,jitter_bits,apic_ticks,time_trust_q48,variance_q48,vm_call_depth_max,hera_heat_q48,hermes_heat_q48,artemis_heat_q48,fleet_k_q48,fleet_conserved,switch_count_cumulative,switch_current_slot,switch_hera_readiness,switch_hermes_readiness,switch_artemis_readiness,switch_ticks_since
+Hera,0000000000000000-0000000000000000,76,760000,10000,0,0,256,61,35,4096,4096,0,0,19515,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,9
+Hera,0000000000000000-0000000000000000,77,770000,10000,0,0,256,62,36,2048,2048,0,0,19517,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,10
+Hera,0000000000000000-0000000000000000,78,780000,10000,0,0,256,62,37,2048,2048,0,0,19519,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,11
+,3a3611885b52444c-91aeb2c971167037,1,10000,18446744073708781616,0,0,93,4,4,4096,0,0,4895412794951728771,19634,65535,1,0,65536,0,0,65536,1,0,2,0,0,0,11
+Hera,0000000000000000-0000000000000000,79,790000,780000,0,0,15572,67,38,1024,1024,0,4694861461728526336,19639,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,12
+,edaab92527ee4080-ac1e0c431056e4e7,1,10000,18446744073708771616,0,0,98,7,8,4096,0,0,4895412794951728766,19763,65535,1,0,65536,0,0,65536,1,0,2,0,0,0,12
+Hera,0000000000000000-0000000000000000,80,800000,790000,0,0,15823,69,39,1024,1024,0,4694947361074446336,19770,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,13
+Hera,0000000000000000-0000000000000000,81,810000,10000,0,0,256,71,40,512,512,0,0,19820,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,14

experiments/bare_metal/runs/doe-amd64-20260925-055533.csv

@@ -0,0 +1,9 @@
+vm_name,vm_id_hex,tick_number,elapsed_ns,tick_interval_ns,cache_hits_delta,bucket_hits_delta,word_executions_delta,hot_word_count,avg_word_heat_q48,window_width,actual_window_size,predicted_label_hits,jitter_bits,apic_ticks,time_trust_q48,variance_q48,vm_call_depth_max,hera_heat_q48,hermes_heat_q48,artemis_heat_q48,fleet_k_q48,fleet_conserved,switch_count_cumulative,switch_current_slot,switch_hera_readiness,switch_hermes_readiness,switch_artemis_readiness,switch_ticks_since
+Hera,0000000000000000-0000000000000000,76,760000,10000,0,0,256,61,35,4096,4096,0,0,20858,65534,2,1,65536,0,0,65536,1,0,2,0,0,0,9
+Hera,0000000000000000-0000000000000000,77,770000,10000,0,0,256,62,36,2048,2048,0,0,20860,65534,2,1,65536,0,0,65536,1,0,2,0,0,0,10
+Hera,0000000000000000-0000000000000000,78,780000,10000,0,0,256,62,37,2048,2048,0,0,20862,65534,2,1,65536,0,0,65536,1,0,2,0,0,0,11
+,3a3611885b52444c-91aeb2c971167037,1,10000,18446744073708781616,0,0,93,4,4,4096,0,0,4895412794951728771,20971,65534,2,0,65536,0,0,65536,1,0,2,0,0,0,11
+Hera,0000000000000000-0000000000000000,79,790000,780000,0,0,15572,67,38,1024,1024,0,4694861461728526336,20976,65534,2,1,65536,0,0,65536,1,0,2,0,0,0,12
+,edaab92527ee4080-ac1e0c431056e4e7,1,10000,18446744073708771616,0,0,98,7,8,4096,0,0,4895412794951728766,21095,65534,2,0,65536,0,0,65536,1,0,2,0,0,0,12
+Hera,0000000000000000-0000000000000000,80,800000,790000,0,0,15823,69,39,1024,1024,0,4694947361074446336,21104,65534,2,1,65536,0,0,65536,1,0,2,0,0,0,13
+Hera,0000000000000000-0000000000000000,81,810000,10000,0,0,256,71,40,512,512,0,0,21152,65534,2,1,65536,0,0,65536,1,0,2,0,0,0,14

experiments/bare_metal/runs/doe-amd64-20260925-071858.csv

@@ -0,0 +1,9 @@
+vm_name,vm_id_hex,tick_number,elapsed_ns,tick_interval_ns,cache_hits_delta,bucket_hits_delta,word_executions_delta,hot_word_count,avg_word_heat_q48,window_width,actual_window_size,predicted_label_hits,jitter_bits,apic_ticks,time_trust_q48,variance_q48,vm_call_depth_max,hera_heat_q48,hermes_heat_q48,artemis_heat_q48,fleet_k_q48,fleet_conserved,switch_count_cumulative,switch_current_slot,switch_hera_readiness,switch_hermes_readiness,switch_artemis_readiness,switch_ticks_since
+Hera,0000000000000000-0000000000000000,76,760000,10000,0,0,256,61,35,4096,4096,0,0,20795,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,9
+Hera,0000000000000000-0000000000000000,77,770000,10000,0,0,256,62,36,2048,2048,0,0,20799,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,10
+Hera,0000000000000000-0000000000000000,78,780000,10000,0,0,256,62,37,2048,2048,0,0,20801,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,11
+,3a3611885b52444c-91aeb2c971167037,1,10000,18446744073708781616,0,0,93,4,4,4096,0,0,4895412794951728771,20912,65536,0,0,65536,0,0,65536,1,0,2,0,0,0,11
+Hera,0000000000000000-0000000000000000,79,790000,780000,0,0,15572,67,38,1024,1024,0,4694861461728526336,20917,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,12
+,edaab92527ee4080-ac1e0c431056e4e7,1,10000,18446744073708771616,0,0,98,7,8,4096,0,0,4895412794951728766,21037,65536,0,0,65536,0,0,65536,1,0,2,0,0,0,12
+Hera,0000000000000000-0000000000000000,80,800000,790000,0,0,15823,69,39,1024,1024,0,4694947361074446336,21045,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,13
+Hera,0000000000000000-0000000000000000,81,810000,10000,0,0,256,71,40,512,512,0,0,21093,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,14

experiments/bare_metal/runs/doe-amd64-20260925-084150.csv

@@ -0,0 +1,9 @@
+vm_name,vm_id_hex,tick_number,elapsed_ns,tick_interval_ns,cache_hits_delta,bucket_hits_delta,word_executions_delta,hot_word_count,avg_word_heat_q48,window_width,actual_window_size,predicted_label_hits,jitter_bits,apic_ticks,time_trust_q48,variance_q48,vm_call_depth_max,hera_heat_q48,hermes_heat_q48,artemis_heat_q48,fleet_k_q48,fleet_conserved,switch_count_cumulative,switch_current_slot,switch_hera_readiness,switch_hermes_readiness,switch_artemis_readiness,switch_ticks_since
+Hera,0000000000000000-0000000000000000,76,760000,10000,0,0,256,61,35,4096,4096,0,0,20870,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,9
+Hera,0000000000000000-0000000000000000,77,770000,10000,0,0,256,62,36,2048,2048,0,0,20872,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,10
+Hera,0000000000000000-0000000000000000,78,780000,10000,0,0,256,62,37,2048,2048,0,0,20874,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,11
+,3a3611885b52444c-91aeb2c971167037,1,10000,18446744073708781616,0,0,93,4,4,4096,0,0,4895412794951728771,20982,65535,1,0,65536,0,0,65536,1,0,2,0,0,0,11
+Hera,0000000000000000-0000000000000000,79,790000,780000,0,0,15572,67,38,1024,1024,0,4694861461728526336,20988,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,12
+,edaab92527ee4080-ac1e0c431056e4e7,1,10000,18446744073708771616,0,0,98,7,8,4096,0,0,4895412794951728766,21109,65535,1,0,65536,0,0,65536,1,0,2,0,0,0,12
+Hera,0000000000000000-0000000000000000,80,800000,790000,0,0,15823,69,39,1024,1024,0,4694947361074446336,21116,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,13
+Hera,0000000000000000-0000000000000000,81,810000,10000,0,0,256,71,40,512,512,0,0,21165,65535,1,1,65536,0,0,65536,1,0,2,0,0,0,14

experiments/bare_metal/runs/doe-amd64-20260925-090302.csv

@@ -0,0 +1,9 @@
+vm_name,vm_id_hex,tick_number,elapsed_ns,tick_interval_ns,cache_hits_delta,bucket_hits_delta,word_executions_delta,hot_word_count,avg_word_heat_q48,window_width,actual_window_size,predicted_label_hits,jitter_bits,apic_ticks,time_trust_q48,variance_q48,vm_call_depth_max,hera_heat_q48,hermes_heat_q48,artemis_heat_q48,fleet_k_q48,fleet_conserved,switch_count_cumulative,switch_current_slot,switch_hera_readiness,switch_hermes_readiness,switch_artemis_readiness,switch_ticks_since
+Hera,0000000000000000-0000000000000000,76,760000,10000,0,0,256,61,35,4096,4096,0,0,22526,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,9
+Hera,0000000000000000-0000000000000000,77,770000,10000,0,0,256,62,36,2048,2048,0,0,22528,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,10
+Hera,0000000000000000-0000000000000000,78,780000,10000,0,0,256,62,37,2048,2048,0,0,22531,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,11
+,3a3611885b52444c-91aeb2c971167037,1,10000,18446744073708781616,0,0,93,4,4,4096,0,0,4895412794951728771,22646,65536,0,0,65536,0,0,65536,1,0,2,0,0,0,11
+Hera,0000000000000000-0000000000000000,79,790000,780000,0,0,15572,67,38,1024,1024,0,4694861461728526336,22654,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,12
+,edaab92527ee4080-ac1e0c431056e4e7,1,10000,18446744073708771616,0,0,98,7,8,4096,0,0,4895412794951728766,22778,65536,0,0,65536,0,0,65536,1,0,2,0,0,0,12
+Hera,0000000000000000-0000000000000000,80,800000,790000,0,0,15823,69,39,1024,1024,0,4694947361074446336,22787,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,13
+Hera,0000000000000000-0000000000000000,81,810000,10000,0,0,256,71,40,512,512,0,0,22857,65536,0,1,65536,0,0,65536,1,0,2,0,0,0,14