CVE-2026-74499: Linux Kernel Heap Out-of-Bounds Write in Akai USB MIDI Output

The snd-usb-audio driver has a quirk for Akai MPD16 controllers. Its output routine computes a loop bound from the device's advertised bulk-OUT transfer size as a signed integer. A device that advertises a tiny endpoint drives that bound negative, and the comparison against an unsigned length then always passes.

Each loop iteration appends SysEx bytes past the end of a transfer buffer that is only max_transfer bytes long. A USB device that lies about its endpoint size turns any write to the created /dev/snd/midi node into a heap out-of-bounds write with attacker-chosen length and content. The fix returns early when there is no room for a single SysEx message.