Hi, On Fri, 18 Sep 2026 18:11:43 +0800, Shuqiao Zhang wrote: > usb_descriptor_fillbuf() expects descriptor arrays to end with NULL. > The high-speed RockUSB array does, but the full-speed array does not. > Full-speed enumeration therefore reads beyond the array and treats > adjacent data as another descriptor pointer. > > On a Luckfox Lyra Ultra (RK3506B), the adjacent interface descriptor > started with bytes 09 04 00 00. They were interpreted as pointer > 0x00000409, causing a data abort in usb_descriptor_fillbuf(). > > [...]
Thanks, Applied to https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu (u-boot-dfu) [1/1] usb: gadget: rockusb: terminate full-speed descriptors https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/commit/8caa41dc679055819051aae25135ef060399ed58 -- Mattijs
