A malicious USB peripheral can panic Zephyr's experimental host stack during enumeration.

A device-controlled configuration descriptor can fail validation after its buffer is freed, leaving cleanup to free the dangling pointer again. The documented outcome is a kernel panic in an experimental, disabled-by-default stack with a dedicated heap. The published fix was not reviewed for this brief, so this cannot lead.