CVE-2025-38495 HID: core: ensure the allocated report buffer can contain the reserved report ID