fix(dwc2): bound RXFLVL/IEPINT-OEPINT storms to avoid Interrupt WDT crashes

[hirokada]

Description

Under a rapid, sustained sequence of USB bus resets (e.g. frequent physical cable plug/unplug cycling, or a downstream host repeatedly re-enumerating), dcd_int_handler() could be starved of CPU for 300ms+ by two different unbounded/high-rate conditions, tripping the ESP32 Interrupt WDT and crashing the device. This PR bounds both, and also fixes a separate NULL-pointer crash left over from a stale TXFE interrupt-enable bit after a bus reset.

Specifically:

• The RXFLVL drain loop had no iteration cap and ran until hardware reported the RX FIFO empty. Under a hostile refill rate (FIFO filling faster than 64 packets/iteration can drain), it could spin unbounded entirely inside the ISR. Added a per-entry iteration cap, and when hit, mask RXFLVLM for a short cooldown instead of re-enabling immediately — otherwise many individually-bounded ISR entries back to back can still starve the CPU in aggregate.
• IEPINT/OEPINT re-entering dcd_int_handler at a pathological rate (e.g. during rapid, repeated re-enumeration attempts) produced the same CPU-starvation crash via a different path. handle_ep_irq() itself is already bounded (a fixed small loop over endpoint count), so this tracks entry rate in a rolling window instead of a per-call iteration count, and backs off with the same cooldown pattern as RXFLVL when the rate is judged pathological.
• handle_bus_reset() left a stale TXFE interrupt-enable bit (diepempmsk) set for endpoints with no queued transfer after a reset. A re-opened endpoint could get a TXFE interrupt before the class driver queued anything, and handle_epin_slave() would dereference the resulting NULL xfer->buffer in dfifo_write_packet() — a LoadProhibited crash. Cleared diepempmsk on bus reset, plus added a direct NULL guard in handle_epin_slave() as defense-in-depth.

Both cooldown activation counts are exposed via lock-free counters (dcd_dwc2_rxflvl_cooldown_count() / dcd_dwc2_ep_irq_cooldown_count()), intended to be read from normal task context — never logged from inside the ISR itself, since ESP_LOG/vprintf's newlib lock is unsafe to call from this interrupt level.

Testing

Verified on hardware with serial log capture under sustained rapid USB cable plug-unplug cycling and repeated device-side reboots (the specific scenario that reliably reproduced the Interrupt WDT / LoadProhibited crashes before this fix). No crashes reproduced over extended (several-minutes-plus) sessions after this fix; the cooldown activation counters were confirmed via log to actually engage under real stress conditions without causing regressions in normal HID/audio traffic.

---

Closed - this was mistakenly opened against the wrong base repository. The corresponding fix has been merged into our internal fork instead.

Checklist

• 🚨 This PR does not introduce breaking changes.
• All CI checks (GH Actions) pass.
• Documentation is updated as needed.
• Tests are updated or added as necessary.
• Code is well-commented, especially in complex areas.
• Git history is clean — commits are squashed to the minimum necessary.

[hirokada]

Closing - this was mistakenly opened against the wrong base repository (should target our internal fork Backbone-Labs/tinyusb, not the upstream project). Re-opening against the correct target.