Best of Sashiko: Later, rmi_read_block() populates item->reg_size bytes. If a malicious peripheral provides a descriptor with a small reg_size but sets multiple bits in subpacket_map "...malicious peripheral..." in the context of a touchscreen. So ‒ you take your phone to a repair center and they install a malicious touchscreen... Personally, I think the most "malicious" touchscreens are the aftermarket ones that claim to implement features they actually don't.