win32ss: fix TOCTOU in NtUserEnumDisplayDevices

[Copilot]

pDisplayDevice->cb was read from user-mode memory up to four times after the initial ProbeForWrite — including as the length argument to RtlCopyMemory. A racing user thread could inflate the value between the probe and the copy, causing the kernel to read past the end of the stack-local dispdev buffer and write that data into user space (kernel stack disclosure).

Fix

Capture pDisplayDevice->cb once into a local variable immediately after the probe, clamp it there, and use only the local for the subsequent ProbeForWrite and RtlCopyMemory.

// before
pDisplayDevice->cb = min(pDisplayDevice->cb, sizeof(dispdev));
ProbeForWrite(pDisplayDevice, pDisplayDevice->cb, 1);       // re-read #1
RtlCopyMemory(pDisplayDevice, &dispdev, pDisplayDevice->cb); // re-read #2

// after
DWORD cbCopy = min(pDisplayDevice->cb, sizeof(dispdev));
ProbeForWrite(pDisplayDevice, cbCopy, 1);
RtlCopyMemory(pDisplayDevice, &dispdev, cbCopy);