CVE-2025-40345 usb: storage: sddr55: Reject out-of-bound new_pba