From ae50d745ca0af4e2e216ee05c54d4a24dd6f2a67 Mon Sep 17 00:00:00 2001
From: Alex Mendoza <05alex.mendozaa@gmail.com>
Date: Fri, 17 Jul 2026 21:48:18 +0200
Subject: [PATCH] [USBHUB] USBH_FdoQueryBusRelations: Fix an off by one (#9298)

Fix an out of bounds heap read when compacting the ghost device list.

Change the loop condition from `GhostPort < DeviceRelations->Count` to
`GhostPort < DeviceRelations->Count - 1` so the array shift never reads
past the last valid entry.
---
 drivers/usb/usbhub/pnp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/usbhub/pnp.c b/drivers/usb/usbhub/pnp.c
index f4d5951f6eb..5d205c45aea 100644
--- a/drivers/usb/usbhub/pnp.c
+++ b/drivers/usb/usbhub/pnp.c
@@ -1392,7 +1392,7 @@ RelationsWorker:
             if (PdoExt(PdoDevice)->EnumFlags & USBHUB_ENUM_FLAG_GHOST_DEVICE)
             {
                 for (GhostPort = Port;
-                     GhostPort < DeviceRelations->Count;
+                     GhostPort < DeviceRelations->Count - 1;
                      GhostPort++)
                 {
                     DeviceRelations->Objects[GhostPort] =