This is a very minor point, unlikely ever to come up.  But just in case...

It's conceivable that a device might transmit different values for a
configuration descriptor's wTotalLength the first time we ask for it (in
order to get the length) and the second time (to get the entire
descriptor).  Should that improbable event occur, the rawdescriptor buffer
could be allocated using a size that's smaller than the length recorded in
the rawdescriptor itself.  This patch protects devio.c against such a
problem.

If you feel this sequence of events is too unlikely to worry about, then
don't bother to apply the patch.