Merge remote-tracking branch 'origin/master' into codex/class-reference-docs

37 files changed, 4444 insertions, 556 deletions

diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index b3e05f60f..fb82e48e3 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -27,11 +27,11 @@ function(tinyusb_sources_get OUTPUT_VAR)
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/host/usbh.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/host/hub.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/cdc/cdc_host.c
+    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/audio/audio_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/hid/hid_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/midi/midi2_host.c
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/msc/msc_host.c
-    ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/class/vendor/vendor_host.c
     # typec
     ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/typec/usbc.c
     PARENT_SCOPE
diff --git a/src/class/audio/audio.h b/src/class/audio/audio.h
index 7981396c2..82db9ed9e 100644
--- a/src/class/audio/audio.h
+++ b/src/class/audio/audio.h
@@ -83,6 +83,71 @@ typedef enum {
   AUDIO_TERM_TYPE_OUT_LOW_FRQ_EFFECTS_SPEAKER = 0x0307,
 } audio_terminal_output_type_t;
 
+/// 2.4 - Audio Class-Bi-directional Terminal Types UAC2
+typedef enum
+{
+  AUDIO_TERM_TYPE_BI_DIRECTIONAL_UNDEFINED = 0x0400,
+  AUDIO_TERM_TYPE_BI_DIRECTIONAL_HEADSET_HAND_HELD = 0x0401,
+  AUDIO_TERM_TYPE_BI_DIRECTIONAL_HEADSET_MOUNTED = 0x0402,
+  AUDIO_TERM_TYPE_BI_DIRECTIONAL_SPEAKERPHONE = 0x0403,
+  AUDIO_TERM_TYPE_BI_DIRECTIONAL_SPEAKERPHONE_ECHO_SUPPRESS = 0x0404,
+  AUDIO_TERM_TYPE_BI_DIRECTIONAL_SPEAKERPHONE_ECHO_CANCEL = 0x0405,
+} audio_terminal_bi_directional_type_t;
+
+/// 2.5 - Audio Class-Telephone Terminal Types UAC2
+typedef enum
+{
+  AUDIO_TERM_TYPE_TELEPHONE_UNDEFINED = 0x0500,
+  AUDIO_TERM_TYPE_TELEPHONE_PHONE_LINE = 0x0501,
+  AUDIO_TERM_TYPE_TELEPHONE_TELEPHONE = 0x0502,
+  AUDIO_TERM_TYPE_TELEPHONE_DOWN_LINE_PHONE = 0x0503,
+} audio_terminal_telephony_type_t;
+
+/// 2.6 - Audio Class-External Types UAC2
+typedef enum
+{
+  AUDIO_TERM_TYPE_EXTERNAL_UNDEFINED = 0x0600,
+  AUDIO_TERM_TYPE_EXTERNAL_ANALOG_CONNECTOR = 0x0601,
+  AUDIO_TERM_TYPE_EXTERNAL_DIGITAL_AUDIO = 0x0602,
+  AUDIO_TERM_TYPE_EXTERNAL_LINE_CONNECTOR = 0x0603,
+  AUDIO_TERM_TYPE_EXTERNAL_LEGACY_AUDIO_CONNECTOR = 0x0604,
+  AUDIO_TERM_TYPE_EXTERNAL_SPDIF_INTERFACE = 0x0605,
+  AUDIO_TERM_TYPE_EXTERNAL_1394_DA_STREAM = 0x0606,
+  AUDIO_TERM_TYPE_EXTERNAL_1394_DV_STREAM_SOUNDTRACK = 0x0607,
+  AUDIO_TERM_TYPE_EXTERNAL_ADAT_LIGHTPIPE = 0x0608,
+  AUDIO_TERM_TYPE_EXTERNAL_TDIF = 0x0609,
+  AUDIO_TERM_TYPE_EXTERNAL_MADI = 0x060A,
+} audio_terminal_external_type_t;
+
+/// 2.7 - Audio Class-Embedded Types UAC2
+typedef enum
+{
+  AUDIO_TERM_TYPE_EMBEDDED_UNDEFINED = 0x0700,
+  AUDIO_TERM_TYPE_EMBEDDED_LEVEL_CALIBRATION_NOISE_SOURCE = 0x0701,
+  AUDIO_TERM_TYPE_EMBEDDED_EQUALIZATION_NOISE = 0x0702,
+  AUDIO_TERM_TYPE_EMBEDDED_CD_PLAYER = 0x0703,
+  AUDIO_TERM_TYPE_EMBEDDED_DAT = 0x0704,
+  AUDIO_TERM_TYPE_EMBEDDED_DCC = 0x0705,
+  AUDIO_TERM_TYPE_EMBEDDED_COMPRESSED_AUDIO_PLAYER = 0x0706,
+  AUDIO_TERM_TYPE_EMBEDDED_ANALOG_TAPE = 0x0707,
+  AUDIO_TERM_TYPE_EMBEDDED_PHONOGRAPH = 0x0708,
+  AUDIO_TERM_TYPE_EMBEDDED_VCR_AUDIO = 0x0709,
+  AUDIO_TERM_TYPE_EMBEDDED_VIDEO_DISC_AUDIO = 0x070A,
+  AUDIO_TERM_TYPE_EMBEDDED_DVD_AUDIO = 0x070B,
+  AUDIO_TERM_TYPE_EMBEDDED_TV_TUNER_AUDIO = 0x070C,
+  AUDIO_TERM_TYPE_EMBEDDED_SATELLITE_RECEIVER_AUDIO = 0x070D,
+  AUDIO_TERM_TYPE_EMBEDDED_CABLE_TUNER_AUDIO = 0x070E,
+  AUDIO_TERM_TYPE_EMBEDDED_DSS_AUDIO = 0x070F,
+  AUDIO_TERM_TYPE_EMBEDDED_RADIO_RECEIVER = 0x0710,
+  AUDIO_TERM_TYPE_EMBEDDED_RADIO_TRANSMITTER = 0x0711,
+  AUDIO_TERM_TYPE_EMBEDDED_MULTI_TRACK_RECORDER = 0x0712,
+  AUDIO_TERM_TYPE_EMBEDDED_SYNTHESIZER = 0x0713,
+  AUDIO_TERM_TYPE_EMBEDDED_PIANO = 0x0714,
+  AUDIO_TERM_TYPE_EMBEDDED_GUITAR = 0x0715,
+  AUDIO_TERM_TYPE_EMBEDDED_DRUMS = 0x0716,
+  AUDIO_TERM_TYPE_EMBEDDED_OTHER_MUSICAL_INSTRUMENT = 0x0717,
+} audio_terminal_embedded_type_t;
+
 /// Rest is yet to be implemented
 
 //--------------------------------------------------------------------+
diff --git a/src/class/audio/audio_device.c b/src/class/audio/audio_device.c
index 94881521a..bc4c7e544 100644
--- a/src/class/audio/audio_device.c
+++ b/src/class/audio/audio_device.c
@@ -1841,7 +1841,7 @@ static bool audiod_calc_tx_packet_sz(audiod_function_t *audio) {
 
 static uint16_t audiod_tx_packet_size(const uint16_t *nominal_size, uint16_t data_count, uint16_t fifo_depth, uint16_t fifo_threshold, uint16_t max_depth) {
   // Flow control need a FIFO size of at least 4*Navg
-  if (nominal_size[1] && nominal_size[1] <= fifo_depth * 4) {
+  if (nominal_size[1] && nominal_size[1] * 4 <= fifo_depth) {
     // Use blackout to prioritize normal size packet
     static int ctrl_blackout = 0;
     uint16_t packet_size;
diff --git a/src/class/audio/audio_host.c b/src/class/audio/audio_host.c
new file mode 100644
index 000000000..d93ff535d
--- /dev/null
+++ b/src/class/audio/audio_host.c
@@ -0,0 +1,2724 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 Zhenjiang Zhang
+ * SPDX-FileCopyrightText: Copyright (c) 2026 HiFiPhile (Zixun LI)
+ * SPDX-License-Identifier: MIT
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+// clang-format off
+/*
+ * USB Audio Host driver architecture
+ * ==================================
+ *
+ * One audioh_interface_t represents an Audio Control (AC) interface and owns
+ * at most one logical stream in each direction. A capture stream receives
+ * isochronous IN data from the device; a playback stream sends isochronous OUT
+ * data to the device. Audio topology remains private, while applications see
+ * each stream as a flat list of format, sample-rate, and channel-count tuples.
+ * Internally, tuples using the same Audio Streaming (AS) alternate setting
+ * share one audioh_as_config_t and refer to a rate source by index.
+ * Only Type-I PCM configurations are exposed. UAC1 requires a discrete
+ * sampling-frequency list; UAC2 Clock Source ranges are expanded into the
+ * bounded public list.
+ *
+ * Mounting discovers the topology and completes any control requests needed
+ * to describe the public configurations:
+ *
+ *   USB enumeration
+ *     audioh_open()
+ *       +-- validate and retain the AC descriptor range
+ *       +-- audioh_parse_as() for each consecutive AS interface
+ *       |     +-- parse the protocol-specific AS and format descriptors
+ *       |     +-- associate the data and optional feedback endpoints
+ *       |     `-- store UAC1 rates or a UAC2 Clock Source reference
+ *       +-- audioh_link_feature_units()
+ *       `-- tuh_audio_descriptor_cb()
+ *
+ *     audioh_set_config()
+ *       +-- UAC2: audioh_mount_clock_next()
+ *       |     `-- RANGE/CUR completion -> next Clock Source
+ *       |                              -> rebuild public configurations
+ *       `-- audioh_mount_feature_unit_next()
+ *             `-- volume RANGE completion -> next logical stream
+ *                                          -> tuh_audio_mount_cb()
+ *                                          -> usbh_driver_set_config_complete()
+ *
+ * UAC1 rates come from each Format Type descriptor, whereas UAC2 rates are
+ * queried from the Clock Sources referenced by the parsed topology. Feature
+ * Unit parsing records master mute and master/logical-channel volume access.
+ * Mount probing reads the volume range from the master or first controlled
+ * logical channel. A device is reported as mounted only after these
+ * asynchronous probes finish.
+ *
+ * Stream configuration is local; stream activation is asynchronous:
+ *
+ *   tuh_audio_configure(stream, configuration)
+ *     +-- resolve the public tuple to AS and rate-source indices
+ *     +-- close endpoints from the previous configuration
+ *     +-- initialize frame size, FIFO, and playback scheduler state
+ *     `-- audioh_stream_open_ep()          (data and optional feedback EP)
+ *
+ *   tuh_audio_start(stream)
+ *     +-- UAC1: SET_INTERFACE(non-zero alt)
+ *     |           `-- optional endpoint SET_CUR(sample rate)
+ *     +-- UAC2: optional Clock Source CUR(sample rate)
+ *     |           `-- SET_INTERFACE(non-zero alt)
+ *     `-- audioh_stream_start_xfer()
+ *           `-- tuh_audio_event_cb(START_COMPLETE)
+ *
+ *   tuh_audio_stop(stream)
+ *     +-- SET_INTERFACE(alt 0) and stop local transfer resubmission
+ *     `-- completion -> tuh_audio_event_cb(STOP_COMPLETE)
+ *
+ * A successful start/stop API return means that the first control request was
+ * submitted. The corresponding event reports completion of the entire chain.
+ * UAC1 sets the rate after activating the endpoint because its control targets
+ * that endpoint; UAC2 sets the Clock Source before activating the AS interface.
+ *
+ * Once started, each endpoint completion prepares and submits its successor:
+ *
+ *   host controller -> audioh_xfer_cb()
+ *     +-- capture data
+ *     |     +-- copy whole audio frames to the overwrite FIFO
+ *     |     +-- tuh_audio_capture_cb()
+ *     |     `-- audioh_stream_capture_xfer()
+ *     +-- playback data
+ *     |     +-- tuh_audio_playback_cb()
+ *     |     `-- audioh_stream_playback_xfer()
+ *     |           +-- calculate the next fractional packet size
+ *     |           +-- read a complete packet from the FIFO, or send silence
+ *     |           `-- submit the next OUT transfer
+ *     `-- explicit feedback
+ *           +-- validate and stage the Q10.14 or Q16.16 rate
+ *           `-- audioh_stream_feedback_xfer()
+ *
+ * tuh_audio_read() and tuh_audio_write() access only the stream FIFOs and do
+ * not need to run from transfer callbacks. The FIFOs decouple application I/O
+ * from USB polling cadence and never expose partial interleaved audio frames.
+ * A transfer failure stops resubmission and is reported through
+ * tuh_audio_event_cb(XFER_FAILED).
+ */
+// clang-format on
+
+#include "tusb_option.h"
+
+#if (CFG_TUH_ENABLED && CFG_TUH_AUDIO)
+
+  #include "host/usbh.h"
+  #include "host/usbh_pvt.h"
+  #include "audio_host.h"
+
+  // Driver-specific log level; defaults to the host-stack log level.
+  #ifndef CFG_TUH_AUDIO_LOG_LEVEL
+    #define CFG_TUH_AUDIO_LOG_LEVEL CFG_TUH_LOG_LEVEL
+  #endif
+
+  #define TU_LOG_DRV(...) TU_LOG(CFG_TUH_AUDIO_LOG_LEVEL, __VA_ARGS__)
+
+
+//--------------------------------------------------------------------+
+// MACROS, CONSTANTS, AND TYPES
+//--------------------------------------------------------------------+
+
+enum {
+  STREAM_STATE_IDLE = 0, // No active configuration.
+  STREAM_STATE_READY     // Configured and ready to start.
+};
+
+enum {
+  AUDIOH_STREAM_OP_NONE = 0,
+  AUDIOH_STREAM_OP_START,
+  AUDIOH_STREAM_OP_STOP
+};
+
+enum {
+  AUDIOH_CTRL_NONE       = 0,
+  AUDIOH_CTRL_READ       = 1,
+  AUDIOH_CTRL_READ_WRITE = 3
+};
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    #define AUDIOH_MAX_RATE_SOURCES (2 * CFG_TUH_AUDIO_MAX_AS)
+  #else
+    #define AUDIOH_MAX_RATE_SOURCES TUH_AUDIO_STREAM_DIRECTION_COUNT
+  #endif
+
+// UAC1 stores one rate source per alternate setting. UAC2 alternate settings
+// that reference the same Clock Source share one rate source.
+typedef struct {
+  uint32_t sample_rate[CFG_TUH_AUDIO_MAX_SAM_FREQ];
+  uint8_t  control_id; // UAC1 endpoint address or UAC2 Clock Source ID.
+  uint8_t  sample_rate_count;
+  uint8_t  frequency_access;
+} audioh_rate_source_t;
+
+// Properties shared by every sampling frequency of one AS alternate setting.
+typedef struct {
+  uint16_t ep_size;
+  uint8_t  itf_num;
+  uint8_t  alt_setting;
+  uint8_t  ep_addr;
+  uint8_t  ep_interval;
+  uint8_t  ep_attr; // Synchronization and usage fields from bmAttributes.
+  uint8_t  format;
+  uint8_t  channels;
+  uint8_t  terminal_id;
+  uint8_t  rate_source_idx;
+  uint8_t  rate_count;
+} audioh_as_config_t;
+
+// Explicit-feedback endpoint associated with a playback alternate setting.
+typedef struct {
+  uint8_t ep_addr;
+  uint8_t ep_size;
+  uint8_t ep_interval;
+  uint8_t ep_attr;
+} audioh_feedback_ep_t;
+
+typedef struct {
+  audioh_feedback_ep_t feedback[CFG_TUH_AUDIO_MAX_AS];
+
+  // Packet rates use Q16.16 audio frames per data-endpoint poll interval. The
+  // scheduler snapshots target_frames_q16 once per packet and retains rem_acc,
+  // which integrates fractional frames across feedback updates.
+  uint32_t nominal_frames_q16;
+  uint32_t target_frames_q16;
+  uint16_t feedback_min_frames;
+  uint16_t feedback_max_frames;
+  uint16_t rem_acc;
+  bool     feedback_opened;
+} audioh_playback_t;
+
+// Control-transfer bookkeeping; transfer payloads are stored in audioh_epbuf_t.
+typedef struct {
+  tuh_xfer_cb_t complete_cb;
+  uintptr_t     user_data;
+  void         *value;
+  union {
+    struct {
+      uint8_t width;
+      uint8_t value_type;
+      uint8_t channel;
+      uint8_t last_channel;
+    } control;
+    struct {
+      uint8_t stream_idx;
+      uint8_t range_step;
+    } mount;
+  } fu;
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+  struct {
+    uint8_t rate_source_idx;
+    bool    read_cur;
+  } clock;
+  #endif
+  bool fu_busy;
+} audioh_ctrl_state_t;
+
+// One logical capture or playback stream.
+typedef struct {
+  // Identity is initialized once and preserved when the stream is reset.
+  uint8_t    idx;
+  uint8_t    stream_idx;
+  tusb_dir_t dir; // TUSB_DIR_IN is capture; TUSB_DIR_OUT is playback.
+
+  // Device address, or zero while this stream slot is unused.
+  uint8_t daddr;
+
+  // Configurations discovered during enumeration.
+  uint8_t            as_count;
+  uint8_t            config_count;
+  audioh_as_config_t as[CFG_TUH_AUDIO_MAX_AS];
+
+  // Selected configuration and runtime state.
+  uint8_t active_config; // Index in the flattened public configuration list.
+  uint8_t active_as;
+  uint8_t active_rate;
+  uint8_t state;
+  uint8_t operation;
+  bool    running;
+
+  // Directly associated Feature Unit, or zero when none is usable.
+  uint8_t                  feature_unit_id;
+  uint8_t                  mute_access;
+  uint8_t                  volume_master_access;
+  uint8_t                  feature_unit_channels;
+  uint8_t                  volume_range_channel;
+  bool                     volume_all_channels_writable;
+  tuh_audio_volume_range_t volume_range;
+
+  // Bytes in one interleaved audio frame across all channels.
+  uint16_t frame_bytes;
+
+  // The FIFO decouples application I/O from isochronous transfers. ep_buf is
+  // assigned during driver initialization and the endpoint during configure.
+  tu_edpt_stream_t edpt;
+  uint8_t          ff_buf[CFG_TUH_AUDIO_STREAM_BUFSIZE];
+} tuh_audio_stream_t;
+
+// State owned by one Audio Control interface.
+typedef struct {
+  uint8_t daddr; // Device address, or zero for a free instance.
+  uint8_t ac_itf_num;
+  uint8_t protocol;
+  uint8_t stream_count;
+  uint8_t rate_source_count;
+  bool    mounted;
+
+  audioh_rate_source_t rate_source[AUDIOH_MAX_RATE_SOURCES];
+
+  // Public stream indices are assigned in playback-then-capture order.
+  tuh_audio_stream_t  out_stream;
+  tuh_audio_stream_t  in_stream;
+  audioh_playback_t   playback;
+  audioh_ctrl_state_t ctrl;
+} audioh_interface_t;
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    #define AUDIOH_CLOCK_RANGE_BUFSIZE (2 + 12 * CFG_TUH_AUDIO_MAX_SAM_FREQ)
+  #endif
+
+typedef struct {
+  // Clock discovery finishes before mount, so its buffer can be reused by
+  // runtime sampling-frequency and Feature Unit requests.
+  union {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    TUH_EPBUF_DEF(clock_range, AUDIOH_CLOCK_RANGE_BUFSIZE);
+  #endif
+    struct {
+      TUH_EPBUF_DEF(rate_ctrl, 4);
+      TUH_EPBUF_DEF(fu_ctrl, 8);
+    } runtime;
+  } control;
+  // Feedback transfers may overlap runtime control transfers, so the feedback buffer is separate.
+  TUH_EPBUF_DEF(feedback, 4);
+  TUH_EPBUF_DEF(epin, CFG_TUH_AUDIO_EPIN_BUFSIZE);
+  TUH_EPBUF_DEF(epout, CFG_TUH_AUDIO_EPOUT_BUFSIZE);
+} audioh_epbuf_t;
+
+static audioh_interface_t _audioh_itf[CFG_TUH_AUDIO_MAX];
+
+CFG_TUH_MEM_SECTION static audioh_epbuf_t _audioh_epbuf[CFG_TUH_AUDIO_MAX];
+
+//--------------------------------------------------------------------+
+// WEAK APPLICATION CALLBACKS
+//--------------------------------------------------------------------+
+
+TU_ATTR_WEAK void tuh_audio_descriptor_cb(uint8_t idx, const tuh_audio_descriptor_cb_t *desc_cb_data) {
+  (void)idx;
+  (void)desc_cb_data;
+}
+
+TU_ATTR_WEAK void tuh_audio_mount_cb(uint8_t idx) {
+  (void)idx;
+}
+
+TU_ATTR_WEAK void tuh_audio_umount_cb(uint8_t idx) {
+  (void)idx;
+}
+
+TU_ATTR_WEAK void tuh_audio_capture_cb(uint8_t idx, uint8_t stream_idx, uint16_t xferred_bytes) {
+  (void)idx;
+  (void)stream_idx;
+  (void)xferred_bytes;
+}
+
+TU_ATTR_WEAK void tuh_audio_playback_cb(uint8_t idx, uint8_t stream_idx, uint16_t xferred_bytes) {
+  (void)idx;
+  (void)stream_idx;
+  (void)xferred_bytes;
+}
+
+TU_ATTR_WEAK void tuh_audio_event_cb(uint8_t idx, uint8_t stream_idx, tuh_audio_event_t event,
+                                     tusb_xfer_result_t result) {
+  (void)idx;
+  (void)stream_idx;
+  (void)event;
+  (void)result;
+}
+
+//--------------------------------------------------------------------+
+// HELPERS
+//--------------------------------------------------------------------+
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t *audioh_rate_ctrl(audioh_epbuf_t *epbuf) {
+  return epbuf->control.runtime.rate_ctrl;
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t *audioh_fu_ctrl(audioh_epbuf_t *epbuf) {
+  return epbuf->control.runtime.fu_ctrl;
+}
+
+TU_ATTR_ALWAYS_INLINE static inline uint8_t find_new_audio_index(void) {
+  for (uint8_t idx = 0; idx < CFG_TUH_AUDIO_MAX; idx++) {
+    if (_audioh_itf[idx].daddr == 0) {
+      return idx;
+    }
+  }
+  return TUSB_INDEX_INVALID_8;
+}
+
+static bool audioh_desc_valid(const uint8_t *p_desc, const uint8_t *desc_end, uint8_t min_len) {
+  if (p_desc >= desc_end) {
+    return false;
+  }
+
+  const size_t remaining = (size_t)(desc_end - p_desc);
+  return TUH_VALIDATE_BASIC(remaining >= min_len) && TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= min_len) &&
+         TUH_VALIDATE_BASIC(tu_desc_len(p_desc) <= remaining);
+}
+
+static bool audioh_protocol_enabled(uint8_t protocol) {
+  switch (protocol) {
+    case AUDIO_INT_PROTOCOL_CODE_V1:
+      return (CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1) != 0;
+    case AUDIO_INT_PROTOCOL_CODE_V2:
+      return (CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2) != 0;
+    default:
+      return false;
+  }
+}
+
+static tuh_audio_stream_t *audioh_get_stream(audioh_interface_t *p_audio, tusb_dir_t direction) {
+  return (direction == TUSB_DIR_IN) ? &p_audio->in_stream : &p_audio->out_stream;
+}
+
+static tuh_audio_stream_t *audioh_get_stream_by_idx(audioh_interface_t *p_audio, uint8_t stream_idx) {
+  for (uint8_t i = 0; i < 2; i++) {
+    tuh_audio_stream_t *s = (i == 0) ? &p_audio->out_stream : &p_audio->in_stream;
+    if (s->as_count > 0 && s->stream_idx == stream_idx) {
+      return s;
+    }
+  }
+  return NULL;
+}
+
+TU_ATTR_ALWAYS_INLINE static inline tuh_audio_stream_t *audioh_get_stream_by_idx_unchecked(
+  audioh_interface_t *p_audio, uint8_t stream_idx) {
+  return (p_audio->out_stream.stream_idx == stream_idx) ? &p_audio->out_stream : &p_audio->in_stream;
+}
+
+TU_ATTR_ALWAYS_INLINE static inline audioh_playback_t *audioh_get_playback(const tuh_audio_stream_t *s) {
+  return &_audioh_itf[s->idx].playback;
+}
+
+TU_ATTR_ALWAYS_INLINE static inline audioh_as_config_t *audioh_stream_active_as(tuh_audio_stream_t *s) {
+  return &s->as[s->active_as];
+}
+
+TU_ATTR_ALWAYS_INLINE static inline audioh_rate_source_t *audioh_as_rate_source(const tuh_audio_stream_t *s,
+                                                                                const audioh_as_config_t *as) {
+  return &_audioh_itf[s->idx].rate_source[as->rate_source_idx];
+}
+
+static bool audioh_as_rate_fits(const audioh_interface_t *p_audio, const tuh_audio_stream_t *stream,
+                                const audioh_as_config_t *as, uint32_t sample_rate);
+
+static bool audioh_stream_resolve_config(const tuh_audio_stream_t *s, uint8_t config_idx, uint8_t *as_idx,
+                                         uint8_t *rate_idx) {
+  for (uint8_t i = 0; i < s->as_count; i++) {
+    if (config_idx < s->as[i].rate_count) {
+      const audioh_as_config_t   *as          = &s->as[i];
+      const audioh_rate_source_t *rate_source = audioh_as_rate_source(s, as);
+      for (uint8_t source_rate_idx = 0; source_rate_idx < rate_source->sample_rate_count; source_rate_idx++) {
+        if (audioh_as_rate_fits(&_audioh_itf[s->idx], s, as, rate_source->sample_rate[source_rate_idx])) {
+          if (config_idx == 0) {
+            *as_idx   = i;
+            *rate_idx = source_rate_idx;
+            return true;
+          }
+          config_idx--;
+        }
+      }
+      return false;
+    }
+    config_idx -= s->as[i].rate_count;
+  }
+  return false;
+}
+
+static void audioh_stream_config_fill(const tuh_audio_stream_t *s, uint8_t as_idx, uint8_t rate_idx,
+                                      tuh_audio_stream_config_t *config) {
+  const audioh_as_config_t   *as          = &s->as[as_idx];
+  const audioh_rate_source_t *rate_source = audioh_as_rate_source(s, as);
+  config->dir         = (s->dir == TUSB_DIR_IN) ? TUH_AUDIO_STREAM_CAPTURE : TUH_AUDIO_STREAM_PLAYBACK;
+  config->format      = (tuh_audio_format_t)as->format;
+  config->sample_rate = rate_source->sample_rate[rate_idx];
+  config->channels    = as->channels;
+}
+
+static bool audioh_stream_config_get(const tuh_audio_stream_t *s, uint8_t config_idx,
+                                     tuh_audio_stream_config_t *config) {
+  uint8_t as_idx;
+  uint8_t rate_idx;
+  TU_VERIFY(audioh_stream_resolve_config(s, config_idx, &as_idx, &rate_idx), false);
+
+  audioh_stream_config_fill(s, as_idx, rate_idx, config);
+  return true;
+}
+
+static void audioh_stream_set_feature_unit(tuh_audio_stream_t *s, uint8_t unit_id, uint8_t mute_access,
+                                           uint8_t volume_master_access, uint8_t channels, uint8_t volume_range_channel,
+                                           bool volume_all_channels_writable) {
+  s->feature_unit_id              = unit_id;
+  s->mute_access                  = mute_access;
+  s->volume_master_access         = volume_master_access;
+  s->feature_unit_channels        = channels;
+  s->volume_range_channel         = volume_range_channel;
+  s->volume_all_channels_writable = volume_all_channels_writable;
+}
+
+static bool audioh_format_from_pcm(uint8_t subslot_size, uint8_t bit_resolution, tuh_audio_format_t *format) {
+  if (subslot_size == 1 && bit_resolution == 8) {
+    *format = TUH_AUDIO_FORMAT_S8;
+  } else if (subslot_size == 2 && bit_resolution == 16) {
+    *format = TUH_AUDIO_FORMAT_S16_LE;
+  } else if (subslot_size == 3 && bit_resolution == 24) {
+    *format = TUH_AUDIO_FORMAT_S24_3LE;
+  } else if (subslot_size == 4 && bit_resolution == 24) {
+    *format = TUH_AUDIO_FORMAT_S24_LE;
+  } else if (subslot_size == 4 && bit_resolution == 32) {
+    *format = TUH_AUDIO_FORMAT_S32_LE;
+  } else {
+    return false;
+  }
+  return true;
+}
+
+// bInterval encodes 2^(bInterval-1) full-speed frames or high-speed microframes.
+static uint32_t audioh_interval_us(uint8_t ep_interval, uint8_t daddr) {
+  const uint32_t unit_us = (tuh_speed_get(daddr) == TUSB_SPEED_HIGH) ? 125u : 1000u;
+  return ((uint32_t)1u << (ep_interval - 1)) * unit_us;
+}
+
+// Convert a nominal sample rate to Q16.16 frames per data endpoint poll
+// interval. Round to the nearest representable value to preserve common
+// fractional rates such as 44.1 frames/ms.
+static uint32_t audioh_nominal_frames_q16(uint32_t sample_rate, uint8_t ep_interval, uint8_t daddr) {
+  const uint64_t numerator = (uint64_t)sample_rate * audioh_interval_us(ep_interval, daddr) * 65536u;
+  return (uint32_t)((numerator + 500000u) / 1000000u);
+}
+
+// Preserve the stream identity and FIFO allocation while clearing device state.
+static void audioh_stream_reset(tuh_audio_stream_t *s) {
+  s->daddr                        = 0;
+  s->stream_idx                   = TUSB_INDEX_INVALID_8;
+  s->as_count                     = 0;
+  s->config_count                 = 0;
+  s->active_config                = TUSB_INDEX_INVALID_8;
+  s->active_as                    = TUSB_INDEX_INVALID_8;
+  s->active_rate                  = TUSB_INDEX_INVALID_8;
+  s->state                        = STREAM_STATE_IDLE;
+  s->running                      = false;
+  s->feature_unit_id              = 0;
+  s->mute_access                  = AUDIOH_CTRL_NONE;
+  s->volume_master_access         = AUDIOH_CTRL_NONE;
+  s->feature_unit_channels        = 0;
+  s->volume_range_channel         = TUSB_INDEX_INVALID_8;
+  s->volume_all_channels_writable = false;
+  s->volume_range                 = (tuh_audio_volume_range_t){0};
+  s->frame_bytes                  = 0;
+  tu_edpt_stream_close(&s->edpt);
+  tu_edpt_stream_clear(&s->edpt);
+}
+
+static void audioh_playback_reset(audioh_playback_t *playback) {
+  tu_memclr(playback, sizeof(*playback));
+}
+
+static tuh_audio_stream_t *audioh_find_stream(uint8_t dev_addr, uint8_t ep_addr) {
+  for (uint8_t idx = 0; idx < CFG_TUH_AUDIO_MAX; idx++) {
+    audioh_interface_t *p_audio = &_audioh_itf[idx];
+    for (uint8_t s = 0; s < 2; s++) {
+      tuh_audio_stream_t *stream = (s == 0) ? &p_audio->in_stream : &p_audio->out_stream;
+      if (stream->daddr == dev_addr && stream->active_config != TUSB_INDEX_INVALID_8) {
+        const audioh_as_config_t *as = audioh_stream_active_as(stream);
+        if (as->ep_addr == ep_addr) {
+          return stream;
+        }
+        const uint8_t feedback_ep = p_audio->playback.feedback[stream->active_as].ep_addr;
+        if (stream->dir == TUSB_DIR_OUT && feedback_ep != 0 && feedback_ep == ep_addr) {
+          return stream;
+        }
+      }
+    }
+  }
+  return NULL;
+}
+
+//--------------------------------------------------------------------+
+// PACKET SCHEDULER
+//--------------------------------------------------------------------+
+
+static void audioh_stream_xfer_failed(tuh_audio_stream_t *s, tusb_xfer_result_t result);
+
+static bool audioh_stream_feedback_xfer(tuh_audio_stream_t *s) {
+  const audioh_feedback_ep_t *feedback = &audioh_get_playback(s)->feedback[s->active_as];
+  TU_VERIFY(usbh_edpt_claim(s->daddr, feedback->ep_addr), false);
+  return usbh_edpt_xfer(s->daddr, feedback->ep_addr, _audioh_epbuf[s->idx].feedback, feedback->ep_size);
+}
+
+static bool audioh_stream_capture_xfer(tuh_audio_stream_t *s) {
+  const audioh_as_config_t *as = audioh_stream_active_as(s);
+  TU_VERIFY(usbh_edpt_claim(s->daddr, as->ep_addr), false);
+  return usbh_edpt_xfer(s->daddr, as->ep_addr, s->edpt.ep_buf, as->ep_size);
+}
+
+static bool audioh_stream_playback_xfer(tuh_audio_stream_t *s) {
+  const audioh_as_config_t *as       = audioh_stream_active_as(s);
+  audioh_playback_t        *playback = audioh_get_playback(s);
+  TU_VERIFY(usbh_edpt_claim(s->daddr, as->ep_addr), false);
+
+  // Use one target for the entire packet calculation. Retaining the fractional
+  // remainder makes the scheduled total follow the sum of changing feedback
+  // values with less than one frame of quantization error.
+  const uint32_t target_q16   = playback->target_frames_q16;
+  uint32_t       frames       = target_q16 >> 16;
+  const uint32_t fraction     = target_q16 & 0xFFFFu;
+  uint32_t       next_rem_acc = playback->rem_acc + fraction;
+  if (next_rem_acc >= 65536u) {
+    next_rem_acc -= 65536u;
+    frames++;
+  }
+
+  const uint16_t bytes = (uint16_t)(frames * s->frame_bytes);
+  if (tu_fifo_count(&s->edpt.ff) < bytes) {
+    // Isochronous OUT must continue at every interval. Send silence until a
+    // complete packet is queued, leaving any partial packet in the FIFO.
+    tu_memclr(s->edpt.ep_buf, bytes);
+  } else {
+    tu_fifo_read_n(&s->edpt.ff, s->edpt.ep_buf, bytes);
+  }
+
+  if (!usbh_edpt_xfer(s->daddr, as->ep_addr, s->edpt.ep_buf, bytes)) {
+    return false;
+  }
+  playback->rem_acc = (uint16_t)next_rem_acc;
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// STREAM CONFIGURATION
+//--------------------------------------------------------------------+
+
+static bool audioh_stream_close_ep(tuh_audio_stream_t *s) {
+  audioh_playback_t *playback = (s->dir == TUSB_DIR_OUT) ? audioh_get_playback(s) : NULL;
+  if (playback != NULL && playback->feedback_opened) {
+    const uint8_t fb_ep_addr = playback->feedback[s->active_as].ep_addr;
+    if (!tuh_edpt_close(s->daddr, fb_ep_addr)) {
+      TU_LOG_DRV("  AUDIO close feedback endpoint failed: addr=%u ep=%02x\r\n", s->daddr, fb_ep_addr);
+      return false;
+    }
+    playback->feedback_opened = false;
+  }
+
+  if (!tu_edpt_stream_is_opened(&s->edpt)) {
+    return true;
+  }
+
+  const uint8_t ep_addr = s->edpt.ep_addr;
+  if (!tuh_edpt_close(s->daddr, ep_addr)) {
+    TU_LOG_DRV("  AUDIO close endpoint failed: addr=%u ep=%02x\r\n", s->daddr, ep_addr);
+    return false;
+  }
+
+  tu_edpt_stream_close(&s->edpt);
+  return true;
+}
+
+static void audioh_stream_fail(tuh_audio_stream_t *s) {
+  (void)audioh_stream_close_ep(s);
+  s->state         = STREAM_STATE_IDLE;
+  s->active_config = TUSB_INDEX_INVALID_8;
+  s->active_as     = TUSB_INDEX_INVALID_8;
+  s->active_rate   = TUSB_INDEX_INVALID_8;
+  s->operation     = AUDIOH_STREAM_OP_NONE;
+  s->running       = false;
+}
+
+static void audioh_stream_stop_xfers(tuh_audio_stream_t *s) {
+  s->running = false;
+  if (s->dir == TUSB_DIR_OUT) {
+    audioh_playback_t *playback = audioh_get_playback(s);
+    playback->target_frames_q16 = playback->nominal_frames_q16;
+    playback->rem_acc           = 0;
+  }
+  tu_edpt_stream_clear(&s->edpt);
+}
+
+static void audioh_stream_xfer_failed(tuh_audio_stream_t *s, tusb_xfer_result_t result) {
+  audioh_stream_stop_xfers(s);
+  tuh_audio_event_cb(s->idx, s->stream_idx, TUH_AUDIO_EVENT_XFER_FAILED, result);
+}
+
+static bool audioh_stream_set_freq(tuh_audio_stream_t *s, tuh_xfer_cb_t complete_cb) {
+  const audioh_as_config_t   *as          = audioh_stream_active_as(s);
+  const audioh_rate_source_t *rate_source = audioh_as_rate_source(s, as);
+  const uint32_t              sample_rate = rate_source->sample_rate[s->active_rate];
+  uint8_t                    *ctrl        = audioh_rate_ctrl(&_audioh_epbuf[s->idx]);
+  tusb_control_request_t      request     = {0};
+
+  ctrl[0] = (uint8_t)(sample_rate & 0xFF);
+  ctrl[1] = (uint8_t)((sample_rate >> 8) & 0xFF);
+  ctrl[2] = (uint8_t)((sample_rate >> 16) & 0xFF);
+  switch (_audioh_itf[s->idx].protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    case AUDIO_INT_PROTOCOL_CODE_V1:
+      request.bmRequestType_bit.recipient = TUSB_REQ_RCPT_ENDPOINT;
+      request.bmRequestType_bit.type      = TUSB_REQ_TYPE_CLASS;
+      request.bmRequestType_bit.direction = TUSB_DIR_OUT;
+      request.bRequest                    = AUDIO10_CS_REQ_SET_CUR;
+      request.wValue                      = tu_htole16(tu_u16(AUDIO10_EP_CTRL_SAMPLING_FREQ, 0));
+      request.wIndex                      = tu_htole16(rate_source->control_id);
+      request.wLength                     = 3;
+      break;
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    case AUDIO_INT_PROTOCOL_CODE_V2:
+      request.bmRequestType_bit.recipient = TUSB_REQ_RCPT_INTERFACE;
+      request.bmRequestType_bit.type      = TUSB_REQ_TYPE_CLASS;
+      request.bmRequestType_bit.direction = TUSB_DIR_OUT;
+      request.bRequest                    = AUDIO20_CS_REQ_CUR;
+      request.wValue                      = tu_htole16(tu_u16(AUDIO20_CS_CTRL_SAM_FREQ, 0));
+      request.wIndex                      = tu_htole16(tu_u16(rate_source->control_id, _audioh_itf[s->idx].ac_itf_num));
+      request.wLength                     = 4;
+      ctrl[3]                             = (uint8_t)(sample_rate >> 24);
+      break;
+  #endif
+    default:
+      return false;
+  }
+
+  tuh_xfer_t xfer = {.daddr       = s->daddr,
+                     .ep_addr     = 0,
+                     .setup       = &request,
+                     .buffer      = ctrl,
+                     .complete_cb = complete_cb,
+                     .user_data   = (uintptr_t)s};
+  return tuh_control_xfer(&xfer);
+}
+
+static bool audioh_stream_open_ep(tuh_audio_stream_t *s) {
+  const audioh_as_config_t *as = audioh_stream_active_as(s);
+
+  const tusb_desc_endpoint_t desc_ep = {.bLength          = sizeof(tusb_desc_endpoint_t),
+                                        .bDescriptorType  = TUSB_DESC_ENDPOINT,
+                                        .bEndpointAddress = as->ep_addr,
+                                        .bmAttributes     = {.xfer  = TUSB_XFER_ISOCHRONOUS,
+                                                             .sync  = (as->ep_attr >> 2) & 0x03u,
+                                                             .usage = (as->ep_attr >> 4) & 0x03u},
+                                        .wMaxPacketSize   = tu_htole16(as->ep_size),
+                                        .bInterval        = as->ep_interval};
+
+  if (!tuh_edpt_open(s->daddr, &desc_ep)) {
+    TU_LOG_DRV("  AUDIO open endpoint failed: addr=%u ep=%02x\r\n", s->daddr, as->ep_addr);
+    audioh_stream_fail(s);
+    return false;
+  }
+
+  // Bind the transfer helper to the selected endpoint and empty its FIFO.
+  const uint16_t xfer_len = (s->dir == TUSB_DIR_IN) ? CFG_TUH_AUDIO_EPIN_BUFSIZE : CFG_TUH_AUDIO_EPOUT_BUFSIZE;
+  tu_edpt_stream_open(&s->edpt, s->daddr, &desc_ep, xfer_len);
+  tu_edpt_stream_clear(&s->edpt);
+
+  if (s->dir == TUSB_DIR_OUT) {
+    audioh_playback_t          *playback = audioh_get_playback(s);
+    const audioh_feedback_ep_t *feedback = &playback->feedback[s->active_as];
+    if (feedback->ep_addr != 0) {
+      const tusb_desc_endpoint_t desc_fb = {.bLength          = sizeof(tusb_desc_endpoint_t),
+                                            .bDescriptorType  = TUSB_DESC_ENDPOINT,
+                                            .bEndpointAddress = feedback->ep_addr,
+                                            .bmAttributes     = {.xfer  = TUSB_XFER_ISOCHRONOUS,
+                                                                 .sync  = (feedback->ep_attr >> 2) & 0x03u,
+                                                                 .usage = (feedback->ep_attr >> 4) & 0x03u},
+                                            .wMaxPacketSize   = tu_htole16(feedback->ep_size),
+                                            .bInterval        = feedback->ep_interval};
+      if (!tuh_edpt_open(s->daddr, &desc_fb)) {
+        TU_LOG_DRV("  AUDIO open feedback endpoint failed: addr=%u ep=%02x\r\n", s->daddr, feedback->ep_addr);
+        audioh_stream_fail(s);
+        return false;
+      }
+      playback->feedback_opened = true;
+    }
+  }
+
+  s->state = STREAM_STATE_READY;
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// USB HOST CLASS DRIVER
+//--------------------------------------------------------------------+
+bool audioh_init(void) {
+  tu_memclr(&_audioh_itf, sizeof(_audioh_itf));
+
+  for (uint8_t idx = 0; idx < CFG_TUH_AUDIO_MAX; idx++) {
+    tuh_audio_stream_t *in  = &_audioh_itf[idx].in_stream;
+    tuh_audio_stream_t *out = &_audioh_itf[idx].out_stream;
+
+    in->idx  = idx;
+    in->dir  = TUSB_DIR_IN;
+    out->idx = idx;
+    out->dir = TUSB_DIR_OUT;
+
+    TU_VERIFY(tu_edpt_stream_init(&in->edpt, true, false, true, in->ff_buf, CFG_TUH_AUDIO_STREAM_BUFSIZE,
+                                  _audioh_epbuf[idx].epin));
+    TU_VERIFY(tu_edpt_stream_init(&out->edpt, true, true, false, out->ff_buf, CFG_TUH_AUDIO_STREAM_BUFSIZE,
+                                  _audioh_epbuf[idx].epout));
+
+    audioh_stream_reset(in);
+    audioh_stream_reset(out);
+    audioh_playback_reset(&_audioh_itf[idx].playback);
+  }
+  return true;
+}
+
+bool audioh_deinit(void) {
+  for (uint8_t idx = 0; idx < CFG_TUH_AUDIO_MAX; idx++) {
+    tu_edpt_stream_deinit(&_audioh_itf[idx].in_stream.edpt);
+    tu_edpt_stream_deinit(&_audioh_itf[idx].out_stream.edpt);
+  }
+  return true;
+}
+
+void audioh_close(uint8_t daddr) {
+  for (uint8_t idx = 0; idx < CFG_TUH_AUDIO_MAX; idx++) {
+    audioh_interface_t *p_audio = &_audioh_itf[idx];
+    if (p_audio->daddr != daddr) {
+      continue;
+    }
+
+    TU_LOG_DRV("  AUDIO close addr = %u index = %u\r\n", daddr, idx);
+    if (p_audio->mounted) {
+      tuh_audio_umount_cb(idx);
+    }
+
+    for (uint8_t s = 0; s < 2; s++) {
+      tuh_audio_stream_t *stream = (s == 0) ? &p_audio->in_stream : &p_audio->out_stream;
+      audioh_stream_reset(stream);
+    }
+    audioh_playback_reset(&p_audio->playback);
+
+    // A disconnected device cannot complete its pending control request.
+    tu_memclr(&p_audio->ctrl, sizeof(p_audio->ctrl));
+
+    p_audio->stream_count      = 0;
+    p_audio->daddr             = 0;
+    p_audio->protocol          = 0;
+    p_audio->rate_source_count = 0;
+    p_audio->mounted           = false;
+  }
+}
+
+static void audioh_feedback_received(tuh_audio_stream_t *s, uint32_t xferred_bytes) {
+  const uint8_t     *fb       = _audioh_epbuf[s->idx].feedback;
+  audioh_playback_t *playback = audioh_get_playback(s);
+  uint32_t           feedback_q16;
+  if (xferred_bytes == 3) {
+    // Three-byte feedback is Q10.14; the scheduler uses Q16.16 throughout.
+    feedback_q16 = ((uint32_t)fb[0] | ((uint32_t)fb[1] << 8) | ((uint32_t)fb[2] << 16)) << 2;
+  } else if (xferred_bytes == 4) {
+    feedback_q16 = (uint32_t)fb[0] | ((uint32_t)fb[1] << 8) | ((uint32_t)fb[2] << 16) | ((uint32_t)fb[3] << 24);
+  } else {
+    TU_LOG_DRV("  AUDIO invalid feedback length: %lu\r\n", (unsigned long)xferred_bytes);
+    return;
+  }
+
+  const uint32_t feedback_min_q16 = (uint32_t)playback->feedback_min_frames << 16;
+  const uint32_t feedback_max_q16 = (uint32_t)playback->feedback_max_frames << 16;
+  if (feedback_q16 < feedback_min_q16 || feedback_q16 > feedback_max_q16) {
+    TU_LOG_DRV("  AUDIO feedback out of range: 0x%08lx\r\n", (unsigned long)feedback_q16);
+    return;
+  }
+
+  // Feedback is measured per USB frame or microframe. Scale it to the data
+  // endpoint's polling interval.
+  const audioh_as_config_t *as            = audioh_stream_active_as(s);
+  const uint64_t            target_q16_64 = (uint64_t)feedback_q16 << (as->ep_interval - 1u);
+  if (target_q16_64 > UINT32_MAX) {
+    return;
+  }
+
+  const uint32_t target_q16 = (uint32_t)target_q16_64;
+  const uint64_t max_bytes  = (((uint64_t)target_q16 + 0xFFFFu) >> 16) * s->frame_bytes;
+  if (max_bytes == 0 || max_bytes > as->ep_size || max_bytes > CFG_TUH_AUDIO_EPOUT_BUFSIZE ||
+      max_bytes > CFG_TUH_AUDIO_STREAM_BUFSIZE) {
+    TU_LOG_DRV("  AUDIO feedback exceeds playback packet capacity: 0x%08lx\r\n", (unsigned long)feedback_q16);
+    return;
+  }
+
+  // Host-class callbacks run serially. The playback scheduler snapshots this
+  // target before calculating a packet, so an update cannot split a packet
+  // calculation across two rates.
+  playback->target_frames_q16 = target_q16;
+}
+
+bool audioh_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes) {
+  tuh_audio_stream_t *s = audioh_find_stream(dev_addr, ep_addr);
+  if (s == NULL) {
+    return false;
+  }
+
+  // Stopping one endpoint does not cancel every transfer that may already be
+  // in flight (for example, a playback data and feedback pair). Ignore those
+  // completions after the stream has stopped.
+  if (!s->running) {
+    return true;
+  }
+
+  // Failed, stalled, and aborted transfers do not carry valid audio data.
+  if (result != XFER_RESULT_SUCCESS) {
+    TU_LOG_DRV("  AUDIO transfer failed: addr=%u ep=%02x result=%u\r\n", dev_addr, ep_addr, result);
+    audioh_stream_xfer_failed(s, (tusb_xfer_result_t)result);
+    return true;
+  }
+
+  const uint8_t feedback_ep = audioh_get_playback(s)->feedback[s->active_as].ep_addr;
+  if (s->dir == TUSB_DIR_OUT && feedback_ep != 0 && ep_addr == feedback_ep) {
+    audioh_feedback_received(s, xferred_bytes);
+    if (!audioh_stream_feedback_xfer(s)) {
+      audioh_stream_xfer_failed(s, XFER_RESULT_FAILED);
+    }
+    return true;
+  }
+
+  if (s->dir == TUSB_DIR_IN) {
+    // Queue whole capture frames, notify the application, then re-arm.
+    const uint16_t bytes = (uint16_t)(xferred_bytes - (xferred_bytes % s->frame_bytes));
+    if (bytes > 0) {
+      tu_fifo_write_n(&s->edpt.ff, s->edpt.ep_buf, bytes);
+    }
+    tuh_audio_capture_cb(s->idx, s->stream_idx, (uint16_t)xferred_bytes);
+    if (s->running && !audioh_stream_capture_xfer(s)) {
+      audioh_stream_xfer_failed(s, XFER_RESULT_FAILED);
+    }
+  } else {
+    // Notify the application before requesting the next playback packet.
+    tuh_audio_playback_cb(s->idx, s->stream_idx, (uint16_t)xferred_bytes);
+    if (s->running && !audioh_stream_playback_xfer(s)) {
+      audioh_stream_xfer_failed(s, XFER_RESULT_FAILED);
+    }
+  }
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// ENUMERATION
+//--------------------------------------------------------------------+
+
+typedef struct {
+  uint8_t id;
+  uint8_t source_id;
+  uint8_t clock_id;
+  uint8_t stream_dir;
+} audioh_terminal_info_t;
+
+typedef struct {
+  uint8_t id;
+  uint8_t source_id;
+  uint8_t mute_access;
+  uint8_t volume_master_access;
+  uint8_t channels;
+  uint8_t volume_range_channel;
+  bool    volume_all_channels_writable;
+} audioh_fu_info_t;
+
+typedef struct {
+  uint8_t id;
+  uint8_t frequency_access;
+} audioh_clock_info_t;
+
+typedef struct {
+  const uint8_t *desc_start;
+  const uint8_t *desc_end;
+} audioh_ac_desc_range_t;
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+static uint8_t audioh_uac2_control_access(uint32_t controls, uint8_t position) {
+  const uint8_t access = (uint8_t)((controls >> position) & 0x03u);
+  return (access == AUDIOH_CTRL_READ || access == AUDIOH_CTRL_READ_WRITE) ? access : AUDIOH_CTRL_NONE;
+}
+  #endif
+
+static bool audioh_as_rate_fits(const audioh_interface_t *p_audio, const tuh_audio_stream_t *stream,
+                                const audioh_as_config_t *as, uint32_t sample_rate) {
+  const uint32_t frame_bytes = (uint32_t)as->channels * tuh_audio_format_bytes((tuh_audio_format_t)as->format);
+  const uint16_t epbuf_size  = (stream->dir == TUSB_DIR_IN) ? CFG_TUH_AUDIO_EPIN_BUFSIZE : CFG_TUH_AUDIO_EPOUT_BUFSIZE;
+  const uint64_t frames_numerator = (uint64_t)sample_rate * audioh_interval_us(as->ep_interval, p_audio->daddr);
+  const uint64_t max_frames       = (frames_numerator + 999999u) / 1000000u;
+  const uint64_t packet_bytes     = max_frames * frame_bytes;
+
+  return packet_bytes > 0 && packet_bytes <= as->ep_size &&
+         (stream->dir != TUSB_DIR_OUT || (packet_bytes <= epbuf_size && packet_bytes <= CFG_TUH_AUDIO_STREAM_BUFSIZE));
+}
+
+static bool audioh_ac_entity_valid(const audioh_interface_t *p_audio, const uint8_t *p_desc) {
+  switch (p_audio->protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    case AUDIO_INT_PROTOCOL_CODE_V1: {
+      switch (tu_desc_subtype(p_desc)) {
+        case AUDIO10_CS_AC_INTERFACE_INPUT_TERMINAL:
+          return TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio10_desc_input_terminal_t));
+        case AUDIO10_CS_AC_INTERFACE_OUTPUT_TERMINAL:
+          return TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio10_desc_output_terminal_t));
+        case AUDIO10_CS_AC_INTERFACE_FEATURE_UNIT: {
+          TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= 7), false);
+          const uint8_t control_size = p_desc[5];
+          const uint8_t control_bytes = (uint8_t)(tu_desc_len(p_desc) - 7);
+          return TUH_VALIDATE_BASIC(control_size > 0) && TUH_VALIDATE_BASIC(control_size <= control_bytes) &&
+                 TUH_VALIDATE_BASIC(control_bytes % control_size == 0);
+        }
+        default:
+          return true;
+      }
+    }
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    case AUDIO_INT_PROTOCOL_CODE_V2:
+      switch (tu_desc_subtype(p_desc)) {
+        case AUDIO20_CS_AC_INTERFACE_INPUT_TERMINAL:
+          return TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio20_desc_input_terminal_t));
+        case AUDIO20_CS_AC_INTERFACE_OUTPUT_TERMINAL:
+          return TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio20_desc_output_terminal_t));
+        case AUDIO20_CS_AC_INTERFACE_FEATURE_UNIT:
+          return TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= 10) &&
+                 TUH_VALIDATE_BASIC((tu_desc_len(p_desc) - 6u) % 4u == 0);
+        case AUDIO20_CS_AC_INTERFACE_CLOCK_SOURCE:
+          return TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio20_desc_clock_source_t));
+        default:
+          return true;
+      }
+  #endif
+    default:
+      return false;
+  }
+}
+
+static bool audioh_ac_terminal_find(const audioh_interface_t *p_audio, const audioh_ac_desc_range_t *range, uint8_t id,
+                                    audioh_terminal_info_t *info) {
+  for (const uint8_t *p_desc = range->desc_start; p_desc < range->desc_end; p_desc = tu_desc_next(p_desc)) {
+    if (tu_desc_type(p_desc) != TUSB_DESC_CS_INTERFACE || tu_desc_len(p_desc) < 4 || p_desc[3] != id) {
+      continue;
+    }
+    switch (p_audio->protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+      case AUDIO_INT_PROTOCOL_CODE_V1:
+        if (tu_desc_subtype(p_desc) == AUDIO10_CS_AC_INTERFACE_INPUT_TERMINAL) {
+          const audio10_desc_input_terminal_t *terminal = (const audio10_desc_input_terminal_t *)p_desc;
+          if (tu_le16toh(terminal->wTerminalType) == AUDIO_TERM_TYPE_USB_STREAMING) {
+            *info = (audioh_terminal_info_t){.id = id, .stream_dir = TUSB_DIR_OUT};
+            return true;
+          }
+        } else if (tu_desc_subtype(p_desc) == AUDIO10_CS_AC_INTERFACE_OUTPUT_TERMINAL) {
+          const audio10_desc_output_terminal_t *terminal = (const audio10_desc_output_terminal_t *)p_desc;
+          if (tu_le16toh(terminal->wTerminalType) == AUDIO_TERM_TYPE_USB_STREAMING) {
+            *info = (audioh_terminal_info_t){.id = id, .source_id = terminal->bSourceID, .stream_dir = TUSB_DIR_IN};
+            return true;
+          }
+        }
+        break;
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+      case AUDIO_INT_PROTOCOL_CODE_V2:
+        if (tu_desc_subtype(p_desc) == AUDIO20_CS_AC_INTERFACE_INPUT_TERMINAL) {
+          const audio20_desc_input_terminal_t *terminal = (const audio20_desc_input_terminal_t *)p_desc;
+          if (tu_le16toh(terminal->wTerminalType) == AUDIO_TERM_TYPE_USB_STREAMING) {
+            *info = (audioh_terminal_info_t){.id = id, .clock_id = terminal->bCSourceID, .stream_dir = TUSB_DIR_OUT};
+            return true;
+          }
+        } else if (tu_desc_subtype(p_desc) == AUDIO20_CS_AC_INTERFACE_OUTPUT_TERMINAL) {
+          const audio20_desc_output_terminal_t *terminal = (const audio20_desc_output_terminal_t *)p_desc;
+          if (tu_le16toh(terminal->wTerminalType) == AUDIO_TERM_TYPE_USB_STREAMING) {
+            *info = (audioh_terminal_info_t){.id         = id,
+                                             .source_id  = terminal->bSourceID,
+                                             .clock_id   = terminal->bCSourceID,
+                                             .stream_dir = TUSB_DIR_IN};
+            return true;
+          }
+        }
+        break;
+  #endif
+      default:
+        return false;
+    }
+  }
+  return false;
+}
+
+static bool audioh_ac_feature_unit_parse(const audioh_interface_t *p_audio, const uint8_t *p_desc,
+                                         audioh_fu_info_t *info) {
+  if (tu_desc_type(p_desc) != TUSB_DESC_CS_INTERFACE) {
+    return false;
+  }
+
+  uint8_t control_offset;
+  uint8_t control_size;
+  uint8_t channels;
+  uint8_t mute_access;
+  switch (p_audio->protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    case AUDIO_INT_PROTOCOL_CODE_V1:
+      if (tu_desc_subtype(p_desc) != AUDIO10_CS_AC_INTERFACE_FEATURE_UNIT) {
+        return false;
+      }
+      control_offset = 6;
+      control_size   = p_desc[5];
+      channels       = (uint8_t)((tu_desc_len(p_desc) - 7u) / control_size - 1u);
+      mute_access = (p_desc[control_offset] & AUDIO10_FU_CONTROL_BM_MUTE) ? AUDIOH_CTRL_READ_WRITE : AUDIOH_CTRL_NONE;
+      break;
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    case AUDIO_INT_PROTOCOL_CODE_V2:
+      if (tu_desc_subtype(p_desc) != AUDIO20_CS_AC_INTERFACE_FEATURE_UNIT) {
+        return false;
+      }
+      control_offset = 5;
+      control_size   = 4;
+      channels       = (uint8_t)((tu_desc_len(p_desc) - 6u) / control_size - 1u);
+      mute_access    = audioh_uac2_control_access(tu_le32toh(tu_unaligned_read32(&p_desc[control_offset])),
+                                                  AUDIO20_FEATURE_UNIT_CTRL_MUTE_POS);
+      break;
+  #endif
+    default:
+      return false;
+  }
+
+  uint8_t volume_master_access         = AUDIOH_CTRL_NONE;
+  uint8_t volume_range_channel         = TUSB_INDEX_INVALID_8;
+  bool    volume_all_channels_writable = channels > 0;
+  for (uint8_t channel = 0; channel <= channels; channel++) {
+    uint8_t access;
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    if (p_audio->protocol == AUDIO_INT_PROTOCOL_CODE_V2) {
+      const uint32_t controls = tu_le32toh(tu_unaligned_read32(&p_desc[control_offset + channel * control_size]));
+      access                  = audioh_uac2_control_access(controls, AUDIO20_FEATURE_UNIT_CTRL_VOLUME_POS);
+    } else
+  #endif
+    {
+      access = (p_desc[control_offset + channel * control_size] & AUDIO10_FU_CONTROL_BM_VOLUME) ? AUDIOH_CTRL_READ_WRITE
+                                                                                                : AUDIOH_CTRL_NONE;
+    }
+    if (channel == 0) {
+      volume_master_access = access;
+    } else {
+      volume_all_channels_writable &= access == AUDIOH_CTRL_READ_WRITE;
+    }
+    if (access != AUDIOH_CTRL_NONE && volume_range_channel == TUSB_INDEX_INVALID_8) {
+      volume_range_channel = channel;
+    }
+  }
+
+  *info = (audioh_fu_info_t){.id                           = p_desc[3],
+                             .source_id                    = p_desc[4],
+                             .mute_access                  = mute_access,
+                             .volume_master_access         = volume_master_access,
+                             .channels                     = channels,
+                             .volume_range_channel         = volume_range_channel,
+                             .volume_all_channels_writable = volume_all_channels_writable};
+  return mute_access != AUDIOH_CTRL_NONE || volume_range_channel != TUSB_INDEX_INVALID_8;
+}
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+static bool audioh_ac_clock_find(const audioh_ac_desc_range_t *range, uint8_t id, audioh_clock_info_t *info) {
+  for (const uint8_t *p_desc = range->desc_start; p_desc < range->desc_end; p_desc = tu_desc_next(p_desc)) {
+    if (tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE &&
+        tu_desc_subtype(p_desc) == AUDIO20_CS_AC_INTERFACE_CLOCK_SOURCE && p_desc[3] == id) {
+      const audio20_desc_clock_source_t *clock = (const audio20_desc_clock_source_t *)p_desc;
+      *info =
+        (audioh_clock_info_t){.id = id,
+                              .frequency_access =
+                                audioh_uac2_control_access(clock->bmControls, AUDIO20_CLOCK_SOURCE_CTRL_CLK_FRQ_POS)};
+      return true;
+    }
+  }
+  return false;
+}
+  #endif
+
+static void audioh_link_feature_units(audioh_interface_t *p_audio, const audioh_ac_desc_range_t *range) {
+  for (uint8_t direction = TUSB_DIR_OUT; direction <= TUSB_DIR_IN; direction++) {
+    tuh_audio_stream_t *stream = audioh_get_stream(p_audio, (tusb_dir_t)direction);
+    if (stream->as_count == 0) {
+      continue;
+    }
+    audioh_terminal_info_t terminal;
+    if (!audioh_ac_terminal_find(p_audio, range, stream->as[0].terminal_id, &terminal) ||
+        terminal.stream_dir != direction) {
+      continue;
+    }
+    for (const uint8_t *p_desc = range->desc_start; p_desc < range->desc_end; p_desc = tu_desc_next(p_desc)) {
+      audioh_fu_info_t fu;
+      if (!audioh_ac_feature_unit_parse(p_audio, p_desc, &fu)) {
+        continue;
+      }
+      const bool linked = (direction == TUSB_DIR_OUT) ? (fu.source_id == terminal.id) : (fu.id == terminal.source_id);
+      if (linked) {
+        audioh_stream_set_feature_unit(stream, fu.id, fu.mute_access, fu.volume_master_access, fu.channels,
+                                       fu.volume_range_channel, fu.volume_all_channels_writable);
+        break;
+      }
+    }
+  }
+}
+
+typedef struct {
+  uint32_t       format_bitmap;
+  uint16_t       format_tag;
+  const uint8_t *sample_rate_data;
+  uint8_t        terminal_id;
+  uint8_t        format_type;
+  uint8_t        channels;
+  uint8_t        subslot_size;
+  uint8_t        bit_resolution;
+  uint8_t        sample_rate_count;
+} audioh_as_class_info_t;
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+static bool audioh_uac1_parse_as_interface(const uint8_t *p_desc, audioh_as_class_info_t *info) {
+  switch (tu_desc_subtype(p_desc)) {
+    case AUDIO10_CS_AS_INTERFACE_AS_GENERAL: {
+      TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio10_desc_cs_as_interface_t)), false);
+      const audio10_desc_cs_as_interface_t *general = (const audio10_desc_cs_as_interface_t *)p_desc;
+      info->terminal_id                             = general->bTerminalLink;
+      info->format_tag                              = tu_le16toh(general->wFormatTag);
+      break;
+    }
+    case AUDIO10_CS_AS_INTERFACE_FORMAT_TYPE:
+      TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= 8), false);
+      info->format_type = p_desc[3];
+      if (info->format_type != AUDIO10_FORMAT_TYPE_I) {
+        break;
+      }
+      info->channels          = p_desc[4];
+      info->subslot_size      = p_desc[5];
+      info->bit_resolution    = p_desc[6];
+      info->sample_rate_count = 0;
+      info->sample_rate_data  = NULL;
+      if (p_desc[7] > 0) {
+        TU_VERIFY(TUH_VALIDATE_BASIC(p_desc[7] <= (tu_desc_len(p_desc) - 8u) / 3u), false);
+        info->sample_rate_count = TU_MIN(p_desc[7], CFG_TUH_AUDIO_MAX_SAM_FREQ);
+        info->sample_rate_data  = &p_desc[8];
+      }
+      break;
+    default:
+      break;
+  }
+  return true;
+}
+  #endif
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+static bool audioh_uac2_parse_as_interface(const uint8_t *p_desc, audioh_as_class_info_t *info) {
+  switch (tu_desc_subtype(p_desc)) {
+    case AUDIO20_CS_AS_INTERFACE_AS_GENERAL: {
+      TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio20_desc_cs_as_interface_t)), false);
+      const audio20_desc_cs_as_interface_t *general = (const audio20_desc_cs_as_interface_t *)p_desc;
+      info->terminal_id                             = general->bTerminalLink;
+      info->format_type                             = general->bFormatType;
+      info->format_bitmap                           = tu_le32toh(general->bmFormats);
+      info->channels                                = general->bNrChannels;
+      break;
+    }
+    case AUDIO20_CS_AS_INTERFACE_FORMAT_TYPE: {
+      TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(audio20_desc_type_I_format_t)), false);
+      const audio20_desc_type_I_format_t *format = (const audio20_desc_type_I_format_t *)p_desc;
+      if (format->bFormatType == AUDIO20_FORMAT_TYPE_I) {
+        info->subslot_size   = format->bSubslotSize;
+        info->bit_resolution = format->bBitResolution;
+      }
+      break;
+    }
+    default:
+      break;
+  }
+  return true;
+}
+  #endif
+
+static bool audioh_parse_as_interface(audioh_interface_t *p_audio, const uint8_t *p_desc,
+                                      audioh_as_class_info_t *info) {
+  switch (p_audio->protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    case AUDIO_INT_PROTOCOL_CODE_V1:
+      return audioh_uac1_parse_as_interface(p_desc, info);
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    case AUDIO_INT_PROTOCOL_CODE_V2:
+      return audioh_uac2_parse_as_interface(p_desc, info);
+  #endif
+    default:
+      return false;
+  }
+}
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+static int8_t audioh_uac2_rate_source_get(audioh_interface_t *p_audio, const audioh_ac_desc_range_t *range,
+                                          const audioh_terminal_info_t *terminal) {
+  if (terminal->clock_id == 0) {
+    return -1;
+  }
+  audioh_clock_info_t clock;
+  if (!audioh_ac_clock_find(range, terminal->clock_id, &clock) || clock.frequency_access == AUDIOH_CTRL_NONE) {
+    return -1;
+  }
+  for (uint8_t i = 0; i < p_audio->rate_source_count; i++) {
+    if (p_audio->rate_source[i].control_id == clock.id) {
+      return (int8_t)i;
+    }
+  }
+  if (p_audio->rate_source_count >= AUDIOH_MAX_RATE_SOURCES) {
+    return -1;
+  }
+  const uint8_t idx = p_audio->rate_source_count++;
+  p_audio->rate_source[idx] =
+    (audioh_rate_source_t){.control_id = clock.id, .frequency_access = clock.frequency_access};
+  return (int8_t)idx;
+}
+  #endif
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+static bool audioh_uac1_rates_store(const audioh_interface_t *p_audio, const tuh_audio_stream_t *stream,
+                                    audioh_as_config_t *as, const audioh_as_class_info_t *info,
+                                    audioh_rate_source_t *rate_source) {
+  for (uint8_t i = 0; i < info->sample_rate_count; i++) {
+    const uint8_t *rate_data = &info->sample_rate_data[i * 3u];
+    const uint32_t sample_rate =
+      (uint32_t)rate_data[0] | ((uint32_t)rate_data[1] << 8) | ((uint32_t)rate_data[2] << 16);
+    if (sample_rate == 0 || !audioh_as_rate_fits(p_audio, stream, as, sample_rate)) {
+      continue;
+    }
+
+    const uint8_t rate_idx             = rate_source->sample_rate_count++;
+    rate_source->sample_rate[rate_idx] = sample_rate;
+    as->rate_count++;
+  }
+  return as->rate_count > 0;
+}
+  #endif
+
+// Parse one AS alternate setting and return the next interface descriptor.
+// Supported configurations are appended to the stream matching its endpoint.
+static const uint8_t *audioh_parse_as(audioh_interface_t *p_audio, const audioh_ac_desc_range_t *ac_desc,
+                                      const tusb_desc_interface_t *desc_itf, const uint8_t *p_desc,
+                                      const uint8_t *desc_end) {
+  const uint8_t itf_num = desc_itf->bInterfaceNumber;
+  const uint8_t alt     = desc_itf->bAlternateSetting;
+
+  p_desc = tu_desc_next(p_desc);
+
+  // Alternate setting zero is the zero-bandwidth setting, not a configuration.
+  if (alt == 0 || desc_itf->bNumEndpoints == 0) {
+    while (p_desc < desc_end) {
+      TU_VERIFY(audioh_desc_valid(p_desc, desc_end, 2), NULL);
+      if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
+        break;
+      }
+      p_desc = tu_desc_next(p_desc);
+    }
+    return p_desc;
+  }
+
+  audioh_as_class_info_t class_info = {0};
+
+  // Retain one data endpoint and, for playback, one explicit-feedback endpoint.
+  // An implicit-feedback IN endpoint remains the data endpoint of its own AS
+  // interface and is therefore exposed as a capture stream.
+  typedef struct {
+    uint8_t  ep_addr;
+    uint16_t ep_size;
+    uint8_t  ep_interval;
+    uint8_t  ep_attr;
+    bool     sam_freq_ctrl;
+  } audioh_ep_info_t;
+  audioh_ep_info_t ep_info         = {0};
+  audioh_ep_info_t fb_info         = {0};
+  bool             has_data_ep     = false;
+  bool             has_feedback_ep = false;
+
+  while (p_desc < desc_end) {
+    TU_VERIFY(audioh_desc_valid(p_desc, desc_end, 2), NULL);
+    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
+      break;
+    }
+
+    switch (tu_desc_type(p_desc)) {
+      case TUSB_DESC_CS_INTERFACE: {
+        TU_VERIFY(audioh_desc_valid(p_desc, desc_end, 3), NULL);
+        TU_VERIFY(audioh_parse_as_interface(p_audio, p_desc, &class_info), NULL);
+        break;
+      }
+      case TUSB_DESC_CS_ENDPOINT: {
+        TU_VERIFY(audioh_desc_valid(p_desc, desc_end, 3), NULL);
+        if (p_audio->protocol == AUDIO_INT_PROTOCOL_CODE_V1 &&
+            tu_desc_subtype(p_desc) == AUDIO10_CS_EP_SUBTYPE_GENERAL) {
+          TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= 4), NULL);
+          const audio10_desc_cs_as_iso_data_ep_t *desc_ep = (const audio10_desc_cs_as_iso_data_ep_t *)p_desc;
+          ep_info.sam_freq_ctrl = (desc_ep->bmAttributes & AUDIO10_CS_AS_ISO_DATA_EP_ATT_SAMPLING_FRQ) != 0;
+        }
+        break;
+      }
+      case TUSB_DESC_ENDPOINT: {
+        TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_len(p_desc) >= sizeof(tusb_desc_endpoint_t)), NULL);
+        const tusb_desc_endpoint_t *desc_endpoint = (const tusb_desc_endpoint_t *)p_desc;
+        if (desc_endpoint->bmAttributes.xfer != TUSB_XFER_ISOCHRONOUS) {
+          break;
+        }
+
+        bool is_data_ep           = false;
+        bool is_explicit_feedback = false;
+        // UAC1 distinguishes feedback by synchronization type; UAC2 uses the
+        // endpoint usage field.
+        switch (p_audio->protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+          case AUDIO_INT_PROTOCOL_CODE_V1:
+            is_data_ep           = desc_endpoint->bmAttributes.sync != TUSB_ISO_EP_ATT_NO_SYNC;
+            is_explicit_feedback = tu_edpt_dir(desc_endpoint->bEndpointAddress) == TUSB_DIR_IN && !is_data_ep;
+            break;
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+          case AUDIO_INT_PROTOCOL_CODE_V2:
+            is_data_ep           = desc_endpoint->bmAttributes.usage == (TUSB_ISO_EP_ATT_DATA >> 4) ||
+                                   desc_endpoint->bmAttributes.usage == (TUSB_ISO_EP_ATT_IMPLICIT_FB >> 4);
+            is_explicit_feedback = tu_edpt_dir(desc_endpoint->bEndpointAddress) == TUSB_DIR_IN &&
+                                   desc_endpoint->bmAttributes.usage == (TUSB_ISO_EP_ATT_EXPLICIT_FB >> 4);
+            break;
+  #endif
+          default:
+            break;
+        }
+
+        if (is_explicit_feedback) {
+          const uint16_t fb_ep_size = tu_edpt_packet_size(desc_endpoint);
+          if (has_feedback_ep || (fb_ep_size != 3 && fb_ep_size != 4)) {
+            TU_LOG_DRV("  AUDIO AS itf %u alt %u: invalid/extra feedback ep %02x ignored\r\n", itf_num, alt,
+                       desc_endpoint->bEndpointAddress);
+            break;
+          }
+
+          fb_info.ep_addr     = desc_endpoint->bEndpointAddress;
+          fb_info.ep_size     = fb_ep_size;
+          fb_info.ep_interval = desc_endpoint->bInterval;
+          if (fb_info.ep_interval == 0 || fb_info.ep_interval > 16) {
+            fb_info.ep_interval = 1;
+          }
+          fb_info.ep_attr =
+            (uint8_t)((desc_endpoint->bmAttributes.sync << 2) | (desc_endpoint->bmAttributes.usage << 4));
+          has_feedback_ep = true;
+          break;
+        }
+
+        if (is_data_ep) {
+          if (has_data_ep) {
+            TU_LOG_DRV("  AUDIO AS itf %u alt %u: extra data ep %02x ignored\r\n", itf_num, alt,
+                       desc_endpoint->bEndpointAddress);
+            break;
+          }
+
+          ep_info.ep_addr     = desc_endpoint->bEndpointAddress;
+          ep_info.ep_size     = tu_edpt_packet_size(desc_endpoint);
+          ep_info.ep_interval = desc_endpoint->bInterval;
+          // Isochronous bInterval is an exponent in the inclusive range 1..16.
+          if (ep_info.ep_interval == 0 || ep_info.ep_interval > 16) {
+            ep_info.ep_interval = 1;
+          }
+          ep_info.ep_attr =
+            (uint8_t)((desc_endpoint->bmAttributes.sync << 2) | (desc_endpoint->bmAttributes.usage << 4));
+          has_data_ep = true;
+        }
+        break;
+      }
+      default:
+        break;
+    }
+    p_desc = tu_desc_next(p_desc);
+  }
+
+  if (!has_data_ep) {
+    return p_desc;
+  }
+
+  bool pcm_supported = false;
+  switch (p_audio->protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    case AUDIO_INT_PROTOCOL_CODE_V1:
+      pcm_supported =
+        class_info.format_type == AUDIO10_FORMAT_TYPE_I && class_info.format_tag == AUDIO10_DATA_FORMAT_TYPE_I_PCM;
+      break;
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    case AUDIO_INT_PROTOCOL_CODE_V2:
+      pcm_supported = class_info.format_type == AUDIO20_FORMAT_TYPE_I &&
+                      (class_info.format_bitmap & AUDIO20_DATA_FORMAT_TYPE_I_PCM) != 0;
+      break;
+  #endif
+    default:
+      break;
+  }
+  if (!pcm_supported) {
+    TU_LOG_DRV("  AUDIO AS itf %u: Type-I PCM format not supported\r\n", itf_num);
+    return p_desc;
+  }
+  tuh_audio_format_t format;
+  if (!audioh_format_from_pcm(class_info.subslot_size, class_info.bit_resolution, &format)) {
+    TU_LOG_DRV("  AUDIO AS itf %u: subslot %u bits %u not supported\r\n", itf_num, class_info.subslot_size,
+               class_info.bit_resolution);
+    return p_desc;
+  }
+  if (class_info.channels == 0) {
+    TU_LOG_DRV("  AUDIO AS itf %u: zero channels not supported\r\n", itf_num);
+    return p_desc;
+  }
+
+  const uint16_t iso_xfer_size =
+    (tuh_speed_get(p_audio->daddr) == TUSB_SPEED_HIGH) ? TUSB_EPSIZE_ISO_HS_MAX : TUSB_EPSIZE_ISO_FS_MAX;
+  const uint32_t frame_bytes_32 = (uint32_t)class_info.channels * tuh_audio_format_bytes(format);
+  if (frame_bytes_32 == 0 || frame_bytes_32 > iso_xfer_size) {
+    TU_LOG_DRV("  AUDIO AS itf %u: frame size %lu not supported\r\n", itf_num, (unsigned long)frame_bytes_32);
+    return p_desc;
+  }
+  // Store the alternate setting once; the public API expands its sampling
+  // frequencies into separate configurations.
+  const audioh_ep_info_t *ep     = &ep_info;
+  tuh_audio_stream_t     *stream = audioh_get_stream(p_audio, tu_edpt_dir(ep->ep_addr));
+  audioh_terminal_info_t terminal;
+  if (!audioh_ac_terminal_find(p_audio, ac_desc, class_info.terminal_id, &terminal) ||
+      terminal.stream_dir != stream->dir) {
+    TU_LOG_DRV("  AUDIO AS itf %u alt %u: terminal %u does not match endpoint direction\r\n", itf_num, alt,
+               class_info.terminal_id);
+    return p_desc;
+  }
+
+  const uint16_t epbuf_size = (stream->dir == TUSB_DIR_IN) ? CFG_TUH_AUDIO_EPIN_BUFSIZE : CFG_TUH_AUDIO_EPOUT_BUFSIZE;
+
+  if (ep->ep_size == 0 || ep->ep_size > iso_xfer_size) {
+    TU_LOG_DRV("  AUDIO AS itf %u alt %u: invalid isochronous ep size %u\r\n", itf_num, alt, ep->ep_size);
+    return p_desc;
+  }
+
+  // Capture always requests the endpoint's maximum packet size, so both the
+  // transfer buffer and FIFO must hold it.
+  if (stream->dir == TUSB_DIR_IN && (ep->ep_size > epbuf_size || ep->ep_size > CFG_TUH_AUDIO_STREAM_BUFSIZE)) {
+    TU_LOG_DRV("  AUDIO AS itf %u alt %u: capture ep size %u exceeds buffer capacity\r\n", itf_num, alt, ep->ep_size);
+    return p_desc;
+  }
+
+  audioh_as_config_t as_config = {.ep_size     = ep->ep_size,
+                                  .itf_num     = itf_num,
+                                  .alt_setting = alt,
+                                  .ep_addr     = ep->ep_addr,
+                                  .ep_interval = ep->ep_interval,
+                                  .ep_attr     = ep->ep_attr,
+                                  .format      = (uint8_t)format,
+                                  .channels    = class_info.channels,
+                                  .terminal_id = class_info.terminal_id};
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+  audioh_rate_source_t rate_source = {0};
+  #endif
+
+  switch (p_audio->protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    case AUDIO_INT_PROTOCOL_CODE_V1:
+      rate_source.control_id       = ep->ep_addr;
+      rate_source.frequency_access = ep->sam_freq_ctrl ? AUDIOH_CTRL_READ_WRITE : AUDIOH_CTRL_NONE;
+      if (!audioh_uac1_rates_store(p_audio, stream, &as_config, &class_info, &rate_source)) {
+        TU_LOG_DRV("  AUDIO AS itf %u alt %u: no supported sampling frequency\r\n", itf_num, alt);
+        return p_desc;
+      }
+      break;
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    case AUDIO_INT_PROTOCOL_CODE_V2: {
+      const int8_t rate_source_idx = audioh_uac2_rate_source_get(p_audio, ac_desc, &terminal);
+      if (rate_source_idx < 0) {
+        TU_LOG_DRV("  AUDIO AS itf %u alt %u: direct Clock Source not found\r\n", itf_num, alt);
+        return p_desc;
+      }
+      as_config.rate_source_idx = (uint8_t)rate_source_idx;
+      break;
+    }
+  #endif
+    default:
+      return p_desc;
+  }
+  if (stream->as_count >= CFG_TUH_AUDIO_MAX_AS) {
+    TU_LOG_DRV("  AUDIO AS itf %u alt %u: reach max alternate settings %u\r\n", itf_num, alt, CFG_TUH_AUDIO_MAX_AS);
+    return p_desc;
+  }
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+  if (p_audio->protocol == AUDIO_INT_PROTOCOL_CODE_V1 && p_audio->rate_source_count >= AUDIOH_MAX_RATE_SOURCES) {
+    TU_LOG_DRV("  AUDIO AS itf %u alt %u: reach max rate sources %u\r\n", itf_num, alt, AUDIOH_MAX_RATE_SOURCES);
+    return p_desc;
+  }
+  #endif
+
+  const uint8_t as_idx = stream->as_count;
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+  if (p_audio->protocol == AUDIO_INT_PROTOCOL_CODE_V1) {
+    as_config.rate_source_idx                          = p_audio->rate_source_count;
+    p_audio->rate_source[p_audio->rate_source_count++] = rate_source;
+  }
+  #endif
+  stream->as[as_idx] = as_config;
+  if (stream->dir == TUSB_DIR_OUT && has_feedback_ep) {
+    audioh_feedback_ep_t *feedback = &p_audio->playback.feedback[as_idx];
+    feedback->ep_addr              = fb_info.ep_addr;
+    feedback->ep_size              = (uint8_t)fb_info.ep_size;
+    feedback->ep_interval          = fb_info.ep_interval;
+    feedback->ep_attr              = fb_info.ep_attr;
+  }
+  stream->as_count++;
+  stream->config_count += as_config.rate_count;
+
+  return p_desc;
+}
+
+uint16_t audioh_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_interface_t *desc_itf, uint16_t max_len) {
+  (void)rhport;
+
+  const uint8_t *desc_start = (const uint8_t *)desc_itf;
+  const uint8_t *p_desc     = desc_start;
+  const uint8_t *desc_end   = desc_start + max_len;
+  TU_VERIFY(audioh_desc_valid(p_desc, desc_end, sizeof(tusb_desc_interface_t)), 0);
+  TU_VERIFY(TUH_VALIDATE_BASIC(tu_desc_type(desc_itf) == TUSB_DESC_INTERFACE), 0);
+  TU_VERIFY(TUSB_CLASS_AUDIO == desc_itf->bInterfaceClass, 0);
+  TU_VERIFY(AUDIO_SUBCLASS_CONTROL == desc_itf->bInterfaceSubClass, 0);
+  TU_VERIFY(audioh_protocol_enabled(desc_itf->bInterfaceProtocol), 0);
+
+  const uint8_t idx = find_new_audio_index();
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX, 0);
+  audioh_interface_t *p_audio = &_audioh_itf[idx];
+  p_audio->daddr              = dev_addr;
+  p_audio->ac_itf_num         = desc_itf->bInterfaceNumber;
+  p_audio->protocol           = desc_itf->bInterfaceProtocol;
+  p_audio->rate_source_count  = 0;
+  tu_memclr(p_audio->rate_source, sizeof(p_audio->rate_source));
+  tu_memclr(&p_audio->ctrl, sizeof(p_audio->ctrl));
+  audioh_stream_reset(&p_audio->in_stream);
+  audioh_stream_reset(&p_audio->out_stream);
+  audioh_playback_reset(&p_audio->playback);
+  p_audio->in_stream.daddr  = dev_addr;
+  p_audio->out_stream.daddr = dev_addr;
+
+  TU_LOG_DRV("AUDIO opening AC Interface %u (addr = %u)\r\n", desc_itf->bInterfaceNumber, dev_addr);
+
+  p_desc                         = tu_desc_next(p_desc);
+  audioh_ac_desc_range_t ac_desc = {.desc_start = p_desc};
+  while (p_desc < desc_end) {
+    if (!audioh_desc_valid(p_desc, desc_end, 2)) {
+      goto open_failed;
+    }
+    if (tu_desc_type(p_desc) == TUSB_DESC_INTERFACE) {
+      break;
+    }
+
+    if (tu_desc_type(p_desc) == TUSB_DESC_CS_INTERFACE) {
+      if (!audioh_desc_valid(p_desc, desc_end, 3)) {
+        goto open_failed;
+      }
+      if (!audioh_ac_entity_valid(p_audio, p_desc)) {
+        goto open_failed;
+      }
+    }
+    p_desc = tu_desc_next(p_desc);
+  }
+  ac_desc.desc_end = p_desc;
+
+  // Audio Streaming interfaces belonging to this function immediately follow
+  // its Audio Control descriptor block.
+  while (p_desc < desc_end) {
+    if (!audioh_desc_valid(p_desc, desc_end, 2)) {
+      goto open_failed;
+    }
+    if (tu_desc_type(p_desc) != TUSB_DESC_INTERFACE) {
+      p_desc = tu_desc_next(p_desc);
+      continue;
+    }
+
+    if (!audioh_desc_valid(p_desc, desc_end, sizeof(tusb_desc_interface_t))) {
+      goto open_failed;
+    }
+    const tusb_desc_interface_t *desc_interface = (const tusb_desc_interface_t *)p_desc;
+    if (desc_interface->bInterfaceClass != TUSB_CLASS_AUDIO ||
+        desc_interface->bInterfaceSubClass != AUDIO_SUBCLASS_STREAMING ||
+        desc_interface->bInterfaceProtocol != p_audio->protocol) {
+      break;
+    }
+
+    TU_LOG_DRV("  Found AS Interface %u (alt = %u)\r\n", desc_interface->bInterfaceNumber,
+               desc_interface->bAlternateSetting);
+    p_desc = audioh_parse_as(p_audio, &ac_desc, desc_interface, p_desc, desc_end);
+    if (p_desc == NULL) {
+      goto open_failed;
+    }
+  }
+
+  audioh_link_feature_units(p_audio, &ac_desc);
+
+  if (p_audio->in_stream.as_count == 0 && p_audio->out_stream.as_count == 0) {
+    goto open_failed;
+  }
+
+  // Assign contiguous public indices in playback-then-capture order.
+  uint8_t stream_idx = 0;
+  if (p_audio->out_stream.as_count > 0) {
+    p_audio->out_stream.stream_idx = stream_idx++;
+  }
+  if (p_audio->in_stream.as_count > 0) {
+    p_audio->in_stream.stream_idx = stream_idx++;
+  }
+  p_audio->stream_count = stream_idx;
+
+  const tuh_audio_descriptor_cb_t desc_cb_data = {
+    .desc_audio_control        = desc_itf,
+    .desc_cs_audio_control     = ac_desc.desc_start,
+    .desc_cs_audio_control_len = (uint16_t)(ac_desc.desc_end - ac_desc.desc_start),
+  };
+  tuh_audio_descriptor_cb(idx, &desc_cb_data);
+
+  return (uint16_t)((uintptr_t)p_desc - (uintptr_t)desc_start);
+
+open_failed:
+  audioh_stream_reset(&p_audio->in_stream);
+  audioh_stream_reset(&p_audio->out_stream);
+  audioh_playback_reset(&p_audio->playback);
+  p_audio->daddr             = 0;
+  p_audio->ac_itf_num        = 0;
+  p_audio->protocol          = 0;
+  p_audio->stream_count      = 0;
+  p_audio->rate_source_count = 0;
+  p_audio->mounted           = false;
+  return 0;
+}
+
+//--------------------------------------------------------------------+
+// SET CONFIGURATION
+//--------------------------------------------------------------------+
+static void audioh_mount_feature_unit_next(uint8_t idx);
+
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+static void audioh_mount_clock_complete(tuh_xfer_t *xfer);
+
+static void audioh_uac2_configs_rebuild(audioh_interface_t *p_audio) {
+  p_audio->in_stream.config_count  = 0;
+  p_audio->out_stream.config_count = 0;
+
+  for (uint8_t direction = TUSB_DIR_OUT; direction <= TUSB_DIR_IN; direction++) {
+    tuh_audio_stream_t *stream = audioh_get_stream(p_audio, (tusb_dir_t)direction);
+    for (uint8_t as_idx = 0; as_idx < stream->as_count; as_idx++) {
+      audioh_as_config_t   *as          = &stream->as[as_idx];
+      audioh_rate_source_t *rate_source = audioh_as_rate_source(stream, as);
+      as->rate_count                    = 0;
+      for (uint8_t rate_idx = 0; rate_idx < rate_source->sample_rate_count; rate_idx++) {
+        if (audioh_as_rate_fits(p_audio, stream, as, rate_source->sample_rate[rate_idx])) {
+          as->rate_count++;
+        }
+      }
+      stream->config_count += as->rate_count;
+    }
+  }
+
+  uint8_t stream_idx             = 0;
+  p_audio->out_stream.stream_idx = TUSB_INDEX_INVALID_8;
+  p_audio->in_stream.stream_idx  = TUSB_INDEX_INVALID_8;
+  if (p_audio->out_stream.config_count > 0) {
+    p_audio->out_stream.stream_idx = stream_idx++;
+  }
+  if (p_audio->in_stream.config_count > 0) {
+    p_audio->in_stream.stream_idx = stream_idx++;
+  }
+  p_audio->stream_count = stream_idx;
+}
+
+static bool audioh_uac2_clock_range_store(audioh_rate_source_t *rate_source, const uint8_t *buffer, uint16_t length) {
+  TU_VERIFY(length >= 2, false);
+  const uint16_t subrange_count = tu_le16toh(tu_unaligned_read16(buffer));
+  const uint16_t available      = (uint16_t)((length - 2u) / 12u);
+  TU_VERIFY(subrange_count > 0 && available > 0, false);
+
+  rate_source->sample_rate_count = 0;
+  const uint16_t parsed_count    = TU_MIN(subrange_count, available);
+  for (uint16_t i = 0; i < parsed_count && rate_source->sample_rate_count < CFG_TUH_AUDIO_MAX_SAM_FREQ; i++) {
+    const uint8_t *subrange = &buffer[2u + 12u * i];
+    const uint32_t min      = tu_le32toh(tu_unaligned_read32(&subrange[0]));
+    const uint32_t max      = tu_le32toh(tu_unaligned_read32(&subrange[4]));
+    const uint32_t res      = tu_le32toh(tu_unaligned_read32(&subrange[8]));
+    if (min == 0 || min > max || (min != max && res == 0)) {
+      continue;
+    }
+    if (min == max) {
+      rate_source->sample_rate[rate_source->sample_rate_count++] = min;
+      continue;
+    }
+    for (uint32_t rate = min; rate <= max && rate_source->sample_rate_count < CFG_TUH_AUDIO_MAX_SAM_FREQ;) {
+      rate_source->sample_rate[rate_source->sample_rate_count++] = rate;
+      if (max - rate < res) {
+        break;
+      }
+      rate += res;
+    }
+  }
+  return rate_source->sample_rate_count > 0;
+}
+
+static bool audioh_mount_clock_submit(uint8_t idx) {
+  audioh_interface_t   *p_audio     = &_audioh_itf[idx];
+  audioh_epbuf_t       *epbuf       = &_audioh_epbuf[idx];
+  audioh_ctrl_state_t  *ctrl        = &p_audio->ctrl;
+  audioh_rate_source_t *rate_source = &p_audio->rate_source[ctrl->clock.rate_source_idx];
+  const uint16_t        length      = ctrl->clock.read_cur ? 4u : (uint16_t)sizeof(epbuf->control.clock_range);
+
+  const tusb_control_request_t request = {
+    .bmRequestType_bit = {.recipient = TUSB_REQ_RCPT_INTERFACE, .type = TUSB_REQ_TYPE_CLASS, .direction = TUSB_DIR_IN},
+    .bRequest          = ctrl->clock.read_cur ? AUDIO20_CS_REQ_CUR : AUDIO20_CS_REQ_RANGE,
+    .wValue            = tu_htole16(tu_u16(AUDIO20_CS_CTRL_SAM_FREQ, 0)),
+    .wIndex            = tu_htole16(tu_u16(rate_source->control_id, p_audio->ac_itf_num)),
+    .wLength           = tu_htole16(length),
+  };
+  tuh_xfer_t xfer = {.daddr       = p_audio->daddr,
+                     .ep_addr     = 0,
+                     .setup       = &request,
+                     .buffer      = epbuf->control.clock_range,
+                     .complete_cb = audioh_mount_clock_complete,
+                     .user_data   = (uintptr_t)idx};
+  return tuh_control_xfer(&xfer);
+}
+
+static void audioh_mount_clock_finish(uint8_t idx) {
+  audioh_interface_t  *p_audio = &_audioh_itf[idx];
+  audioh_ctrl_state_t *ctrl    = &p_audio->ctrl;
+  ctrl->fu_busy                = false;
+  audioh_uac2_configs_rebuild(p_audio);
+
+  if (p_audio->stream_count == 0) {
+    const uint8_t daddr   = p_audio->daddr;
+    const uint8_t itf_num = p_audio->ac_itf_num;
+    audioh_stream_reset(&p_audio->in_stream);
+    audioh_stream_reset(&p_audio->out_stream);
+    audioh_playback_reset(&p_audio->playback);
+    p_audio->daddr             = 0;
+    p_audio->ac_itf_num        = 0;
+    p_audio->protocol          = 0;
+    p_audio->rate_source_count = 0;
+    usbh_driver_set_config_complete(daddr, itf_num);
+    return;
+  }
+
+  ctrl->fu.mount.stream_idx = 0;
+  audioh_mount_feature_unit_next(idx);
+}
+
+static void audioh_mount_clock_next(uint8_t idx) {
+  audioh_interface_t  *p_audio = &_audioh_itf[idx];
+  audioh_ctrl_state_t *ctrl    = &p_audio->ctrl;
+
+  while (ctrl->clock.rate_source_idx < p_audio->rate_source_count) {
+    ctrl->clock.read_cur = false;
+    ctrl->fu_busy        = true;
+    if (audioh_mount_clock_submit(idx)) {
+      return;
+    }
+    p_audio->rate_source[ctrl->clock.rate_source_idx].sample_rate_count = 0;
+    ctrl->clock.rate_source_idx++;
+  }
+  audioh_mount_clock_finish(idx);
+}
+
+static void audioh_mount_clock_complete(tuh_xfer_t *xfer) {
+  const uint8_t        idx     = (uint8_t)xfer->user_data;
+  audioh_interface_t  *p_audio = &_audioh_itf[idx];
+  audioh_ctrl_state_t *ctrl    = &p_audio->ctrl;
+  audioh_epbuf_t      *epbuf   = &_audioh_epbuf[idx];
+  if (!ctrl->fu_busy) {
+    return;
+  }
+  audioh_rate_source_t *rate_source = &p_audio->rate_source[ctrl->clock.rate_source_idx];
+
+  bool success = xfer->result == XFER_RESULT_SUCCESS;
+  if (success && ctrl->clock.read_cur) {
+    success = xfer->actual_len == 4;
+    if (success) {
+      const uint32_t current = tu_le32toh(tu_unaligned_read32(epbuf->control.clock_range));
+      success                = current > 0;
+      if (success) {
+        rate_source->sample_rate[0]    = current;
+        rate_source->sample_rate_count = 1;
+      }
+    }
+  } else if (success) {
+    success = audioh_uac2_clock_range_store(rate_source, epbuf->control.clock_range, (uint16_t)xfer->actual_len);
+    if (success && rate_source->frequency_access == AUDIOH_CTRL_READ) {
+      ctrl->clock.read_cur = true;
+      if (audioh_mount_clock_submit(idx)) {
+        return;
+      }
+      success = false;
+    }
+  }
+
+  if (!success) {
+    rate_source->sample_rate_count = 0;
+  }
+  ctrl->fu_busy = false;
+  ctrl->clock.rate_source_idx++;
+  audioh_mount_clock_next(idx);
+}
+  #endif
+
+bool audioh_set_config(uint8_t dev_addr, uint8_t itf_num) {
+  uint8_t idx = TUSB_INDEX_INVALID_8;
+  for (uint8_t i = 0; i < CFG_TUH_AUDIO_MAX; i++) {
+    if (_audioh_itf[i].daddr == dev_addr && _audioh_itf[i].ac_itf_num == itf_num) {
+      idx = i;
+      break;
+    }
+  }
+
+  if (idx == TUSB_INDEX_INVALID_8) {
+    // Only the Audio Control interface drives mounting. Streaming alternate
+    // settings are selected later by tuh_audio_start().
+    usbh_driver_set_config_complete(dev_addr, itf_num);
+    return true;
+  }
+
+  audioh_ctrl_state_t *ctrl = &_audioh_itf[idx].ctrl;
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+  if (_audioh_itf[idx].protocol == AUDIO_INT_PROTOCOL_CODE_V2) {
+    ctrl->clock.rate_source_idx = 0;
+    audioh_mount_clock_next(idx);
+  } else
+  #endif
+  {
+    ctrl->fu.mount.stream_idx = 0;
+    audioh_mount_feature_unit_next(idx);
+  }
+  return true;
+}
+
+//--------------------------------------------------------------------+
+// APPLICATION API
+//--------------------------------------------------------------------+
+bool tuh_audio_mounted(uint8_t idx) {
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX);
+  return _audioh_itf[idx].mounted;
+}
+
+uint8_t tuh_audio_get_dev_addr(uint8_t idx) {
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX, 0);
+  return _audioh_itf[idx].daddr;
+}
+
+bool tuh_audio_mute_supported(uint8_t idx, uint8_t stream_idx) {
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[idx];
+  TU_VERIFY(p_audio->mounted, false);
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  return s != NULL && s->mute_access != AUDIOH_CTRL_NONE;
+}
+
+bool tuh_audio_volume_range_get(uint8_t idx, uint8_t stream_idx, tuh_audio_volume_range_t *range) {
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX && range != NULL, false);
+  audioh_interface_t *p_audio = &_audioh_itf[idx];
+  TU_VERIFY(p_audio->mounted, false);
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s != NULL && s->volume_range_channel != TUSB_INDEX_INVALID_8, false);
+  *range = s->volume_range;
+  return true;
+}
+
+uint8_t tuh_audio_stream_count(uint8_t dev_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, 0);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, 0);
+  return p_audio->stream_count;
+}
+
+bool tuh_audio_stream_exists(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, false);
+  return audioh_get_stream_by_idx(p_audio, stream_idx) != NULL;
+}
+
+tuh_audio_direction_t tuh_audio_stream_direction(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, TUH_AUDIO_STREAM_DIRECTION_COUNT);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, TUH_AUDIO_STREAM_DIRECTION_COUNT);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s, TUH_AUDIO_STREAM_DIRECTION_COUNT);
+  return (s->dir == TUSB_DIR_IN) ? TUH_AUDIO_STREAM_CAPTURE : TUH_AUDIO_STREAM_PLAYBACK;
+}
+
+uint8_t tuh_audio_config_count(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, 0);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, 0);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s, 0);
+  return s->config_count;
+}
+uint8_t tuh_audio_active_config(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, TUSB_INDEX_INVALID_8);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, TUSB_INDEX_INVALID_8);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s, TUSB_INDEX_INVALID_8);
+  return s->active_config;
+}
+bool tuh_audio_config_get(uint8_t dev_idx, uint8_t stream_idx, uint8_t config_idx, tuh_audio_stream_config_t *config) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, false);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && config, false);
+
+  return audioh_stream_config_get(s, config_idx, config);
+}
+
+bool tuh_audio_configure(uint8_t dev_idx, uint8_t stream_idx, uint8_t config_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->mounted, false);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s, false);
+  tuh_audio_stream_config_t cfg;
+  uint8_t                   as_idx;
+  uint8_t                   rate_idx;
+  TU_VERIFY(audioh_stream_resolve_config(s, config_idx, &as_idx, &rate_idx), false);
+  audioh_stream_config_fill(s, as_idx, rate_idx, &cfg);
+  TU_VERIFY(!s->running, false);
+  if (s->state == STREAM_STATE_READY) {
+    // Configuration cannot close an endpoint while its final transfer drains.
+    TU_VERIFY(!usbh_edpt_busy(s->daddr, s->edpt.ep_addr), false);
+    if (s->dir == TUSB_DIR_OUT && p_audio->playback.feedback_opened) {
+      TU_VERIFY(!usbh_edpt_busy(s->daddr, p_audio->playback.feedback[s->active_as].ep_addr), false);
+    }
+  }
+
+  // Reopen even when the address is unchanged: packet size and interval belong
+  // to the alternate setting and may differ.
+  TU_VERIFY(audioh_stream_close_ep(s), false);
+
+  const audioh_as_config_t *as = &s->as[as_idx];
+  s->active_config             = config_idx;
+  s->active_as                 = as_idx;
+  s->active_rate               = rate_idx;
+  s->frame_bytes               = (uint16_t)tuh_audio_config_frame_size(&cfg);
+  s->state                     = STREAM_STATE_IDLE;
+  if (s->dir == TUSB_DIR_OUT) {
+    const uint32_t     frame_div  = (tuh_speed_get(s->daddr) == TUSB_SPEED_HIGH) ? 8000u : 1000u;
+    audioh_playback_t *playback   = &p_audio->playback;
+    playback->nominal_frames_q16  = audioh_nominal_frames_q16(cfg.sample_rate, as->ep_interval, s->daddr);
+    playback->target_frames_q16   = playback->nominal_frames_q16;
+    playback->feedback_min_frames = (uint16_t)((cfg.sample_rate - 1u) / frame_div);
+    playback->feedback_max_frames = (uint16_t)(cfg.sample_rate / frame_div + 1u);
+    playback->rem_acc             = 0;
+  }
+  if (s->dir == TUSB_DIR_IN) {
+    // Overwrite mode is frame-safe only when FIFO depth is a whole-frame multiple.
+    const uint16_t fifo_depth = CFG_TUH_AUDIO_STREAM_BUFSIZE - (CFG_TUH_AUDIO_STREAM_BUFSIZE % s->frame_bytes);
+    if (!tu_fifo_config(&s->edpt.ff, s->ff_buf, fifo_depth, true)) {
+      audioh_stream_fail(s);
+      return false;
+    }
+  }
+
+  TU_LOG_DRV("  AUDIO configure %s stream %u: itf %u alt %u ep %02x\r\n",
+             (s->dir == TUSB_DIR_IN) ? "capture" : "playback", s->stream_idx, as->itf_num, as->alt_setting,
+             as->ep_addr);
+
+  return audioh_stream_open_ep(s);
+}
+
+// Start endpoint transfers after the alternate setting and sampling frequency
+// are both active.
+static bool audioh_stream_start_xfer(tuh_audio_stream_t *s) {
+  if (s->dir == TUSB_DIR_IN) {
+    return audioh_stream_capture_xfer(s);
+  } else {
+    if (audioh_get_playback(s)->feedback[s->active_as].ep_addr != 0) {
+      TU_VERIFY(audioh_stream_feedback_xfer(s), false);
+    }
+    return audioh_stream_playback_xfer(s);
+  }
+}
+
+static void audioh_stream_start_done(tuh_audio_stream_t *s, tusb_xfer_result_t result) {
+  if (result != XFER_RESULT_SUCCESS) {
+    audioh_stream_stop_xfers(s);
+  }
+  s->operation = AUDIOH_STREAM_OP_NONE;
+  tuh_audio_event_cb(s->idx, s->stream_idx, TUH_AUDIO_EVENT_START_COMPLETE, result);
+}
+
+static void audioh_stream_start_xfers(tuh_audio_stream_t *s) {
+  const tusb_xfer_result_t result = audioh_stream_start_xfer(s) ? XFER_RESULT_SUCCESS : XFER_RESULT_FAILED;
+  audioh_stream_start_done(s, result);
+}
+
+static void audioh_stream_start_complete(tuh_xfer_t *xfer);
+
+static bool audioh_stream_activate(tuh_audio_stream_t *s) {
+  const audioh_as_config_t *as = audioh_stream_active_as(s);
+  return tuh_interface_set(s->daddr, as->itf_num, as->alt_setting, audioh_stream_start_complete, (uintptr_t)s);
+}
+
+static void audioh_stream_start_set_freq_complete(tuh_xfer_t *xfer) {
+  tuh_audio_stream_t *s = (tuh_audio_stream_t *)xfer->user_data;
+  if (s->daddr != xfer->daddr || s->state != STREAM_STATE_READY || !s->running) {
+    // Ignore a completion delivered after disconnect or stop.
+    return;
+  }
+  if (xfer->result != XFER_RESULT_SUCCESS) {
+    TU_LOG_DRV("  AUDIO set sampling frequency failed: result=%u\r\n", xfer->result);
+    audioh_stream_start_done(s, xfer->result);
+    return;
+  }
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+  if (_audioh_itf[s->idx].protocol == AUDIO_INT_PROTOCOL_CODE_V2) {
+    if (!audioh_stream_activate(s)) {
+      audioh_stream_start_done(s, XFER_RESULT_FAILED);
+    }
+  } else
+  #endif
+  {
+    audioh_stream_start_xfers(s);
+  }
+}
+
+static void audioh_stream_start_active(tuh_audio_stream_t *s) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+  const audioh_as_config_t   *as          = audioh_stream_active_as(s);
+  const audioh_rate_source_t *rate_source = audioh_as_rate_source(s, as);
+  if (_audioh_itf[s->idx].protocol == AUDIO_INT_PROTOCOL_CODE_V1 &&
+      rate_source->frequency_access == AUDIOH_CTRL_READ_WRITE) {
+    if (!audioh_stream_set_freq(s, audioh_stream_start_set_freq_complete)) {
+      audioh_stream_start_done(s, XFER_RESULT_FAILED);
+    }
+    return;
+  } else
+  #endif
+  {
+    audioh_stream_start_xfers(s);
+  }
+}
+
+static void audioh_stream_start_complete(tuh_xfer_t *xfer) {
+  tuh_audio_stream_t *s = (tuh_audio_stream_t *)xfer->user_data;
+  if (s->daddr != xfer->daddr || s->state != STREAM_STATE_READY || !s->running) {
+    // Ignore a completion delivered after disconnect or stop.
+    return;
+  }
+  if (xfer->result != XFER_RESULT_SUCCESS) {
+    TU_LOG_DRV("  AUDIO SET_INTERFACE activate failed: result=%u\r\n", xfer->result);
+    audioh_stream_start_done(s, xfer->result);
+    return;
+  }
+  audioh_stream_start_active(s);
+}
+
+bool tuh_audio_start(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->mounted, false);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s, false);
+  TU_VERIFY(s->state == STREAM_STATE_READY && s->operation == AUDIOH_STREAM_OP_NONE && !s->running, false);
+  // A stopped transfer must drain before the endpoint can be restarted.
+  const audioh_as_config_t   *as          = audioh_stream_active_as(s);
+  const audioh_rate_source_t *rate_source = audioh_as_rate_source(s, as);
+  TU_VERIFY(!usbh_edpt_busy(s->daddr, as->ep_addr), false);
+  if (s->dir == TUSB_DIR_OUT && p_audio->playback.feedback_opened) {
+    TU_VERIFY(!usbh_edpt_busy(s->daddr, p_audio->playback.feedback[s->active_as].ep_addr), false);
+  }
+
+  // Capture and playback must use the same rate while both are running.
+  tuh_audio_stream_t *other = (s == &p_audio->out_stream) ? &p_audio->in_stream : &p_audio->out_stream;
+  if (other->running) {
+    const audioh_as_config_t   *other_as          = audioh_stream_active_as(other);
+    const audioh_rate_source_t *other_rate_source = audioh_as_rate_source(other, other_as);
+    const uint32_t              sample_rate       = rate_source->sample_rate[s->active_rate];
+    const uint32_t              other_sample_rate = other_rate_source->sample_rate[other->active_rate];
+    if (sample_rate != other_sample_rate) {
+      TU_LOG_DRV("  AUDIO start failed: capture/playback sample rates must match (%lu != %lu)\r\n",
+                 (unsigned long)sample_rate, (unsigned long)other_sample_rate);
+      return false;
+    }
+  }
+
+  if (s->dir == TUSB_DIR_OUT) {
+    p_audio->playback.target_frames_q16 = p_audio->playback.nominal_frames_q16;
+    p_audio->playback.rem_acc           = 0;
+  }
+  s->running   = true;
+  s->operation = AUDIOH_STREAM_OP_START;
+  // UAC2 controls a Clock Source that exists before endpoint activation. UAC1
+  // controls the endpoint itself, so its alternate setting must be active first.
+  bool submitted = false;
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+  if (p_audio->protocol == AUDIO_INT_PROTOCOL_CODE_V2 && rate_source->frequency_access == AUDIOH_CTRL_READ_WRITE) {
+    submitted = audioh_stream_set_freq(s, audioh_stream_start_set_freq_complete);
+  } else
+  #endif
+  {
+    submitted = audioh_stream_activate(s);
+  }
+  if (!submitted) {
+    s->operation = AUDIOH_STREAM_OP_NONE;
+    s->running   = false;
+    return false;
+  }
+  return true;
+}
+
+static void audioh_stream_stop_complete(tuh_xfer_t *xfer) {
+  tuh_audio_stream_t *s = (tuh_audio_stream_t *)xfer->user_data;
+  if (s->daddr != xfer->daddr || s->operation != AUDIOH_STREAM_OP_STOP) {
+    return;
+  }
+  TU_LOG_DRV("  AUDIO SET_INTERFACE deactivate done: result=%u\r\n", xfer->result);
+  s->operation = AUDIOH_STREAM_OP_NONE;
+  tuh_audio_event_cb(s->idx, s->stream_idx, TUH_AUDIO_EVENT_STOP_COMPLETE, xfer->result);
+}
+
+bool tuh_audio_stop(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->mounted, false);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && s->state == STREAM_STATE_READY && s->operation == AUDIOH_STREAM_OP_NONE && s->running, false);
+
+  const audioh_as_config_t *as = audioh_stream_active_as(s);
+  // Preserve running state when submission fails so the caller can retry.
+  TU_VERIFY(tuh_interface_set(s->daddr, as->itf_num, 0, audioh_stream_stop_complete, (uintptr_t)s), false);
+
+  // SET_INTERFACE stops future traffic. The current transfer drains, while its
+  // data and all queued frames are discarded.
+  s->operation = AUDIOH_STREAM_OP_STOP;
+  audioh_stream_stop_xfers(s);
+  return true;
+}
+
+uint32_t tuh_audio_write(uint8_t dev_idx, uint8_t stream_idx, const void *buffer, uint32_t frame_count) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, 0);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->mounted && buffer, 0);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && s->dir == TUSB_DIR_OUT, 0);
+  TU_VERIFY(s->state == STREAM_STATE_READY && s->running, 0);
+
+  // Never split an audio frame at the FIFO boundary.
+  const uint32_t frames = TU_MIN(frame_count, tu_fifo_remaining(&s->edpt.ff) / s->frame_bytes);
+  if (frames == 0) {
+    return 0;
+  }
+  tu_fifo_write_n(&s->edpt.ff, buffer, (uint16_t)(frames * s->frame_bytes));
+
+  return frames;
+}
+
+uint32_t tuh_audio_read(uint8_t dev_idx, uint8_t stream_idx, void *buffer, uint32_t frame_count) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, 0);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->mounted && buffer, 0);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && s->dir == TUSB_DIR_IN, 0);
+  TU_VERIFY(s->state == STREAM_STATE_READY && s->running, 0);
+
+  // Never return a partial audio frame.
+  const uint32_t frames = TU_MIN(frame_count, tu_fifo_count(&s->edpt.ff) / s->frame_bytes);
+  if (frames > 0) {
+    tu_fifo_read_n(&s->edpt.ff, buffer, (uint16_t)(frames * s->frame_bytes));
+  }
+  return frames;
+}
+
+uint32_t tuh_audio_write_available(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, 0);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, 0);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && s->dir == TUSB_DIR_OUT, 0);
+  TU_VERIFY(s->state == STREAM_STATE_READY && s->running, 0);
+  return tu_edpt_stream_write_available(&s->edpt) / s->frame_bytes;
+}
+
+uint32_t tuh_audio_read_available(uint8_t dev_idx, uint8_t stream_idx) {
+  TU_VERIFY(dev_idx < CFG_TUH_AUDIO_MAX, 0);
+  audioh_interface_t *p_audio = &_audioh_itf[dev_idx];
+  TU_VERIFY(p_audio->daddr != 0, 0);
+
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && s->dir == TUSB_DIR_IN, 0);
+  TU_VERIFY(s->state == STREAM_STATE_READY && s->running, 0);
+  return tu_edpt_stream_read_available(&s->edpt) / s->frame_bytes;
+}
+
+//--------------------------------------------------------------------+
+// AUDIO CONTROL REQUESTS
+//--------------------------------------------------------------------+
+
+static void audioh_fu_set_complete(tuh_xfer_t *xfer);
+
+enum {
+  AUDIOH_FU_VALUE_BOOL,
+  AUDIOH_FU_VALUE_I16
+};
+
+static uint8_t audioh_control_cur_request(uint8_t protocol, tusb_dir_t direction) {
+  #if !(CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1)
+  (void)direction;
+  #endif
+  switch (protocol) {
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC1
+    case AUDIO_INT_PROTOCOL_CODE_V1:
+      return (direction == TUSB_DIR_IN) ? AUDIO10_CS_REQ_GET_CUR : AUDIO10_CS_REQ_SET_CUR;
+  #endif
+  #if CFG_TUH_AUDIO_PROTOCOLS & TUH_AUDIO_PROTOCOL_UAC2
+    case AUDIO_INT_PROTOCOL_CODE_V2:
+      return AUDIO20_CS_REQ_CUR;
+  #endif
+    default:
+      return 0;
+  }
+}
+
+static bool audioh_control_submit(uint8_t idx, uint8_t entity_id, tusb_dir_t direction, uint8_t request,
+                                  uint8_t control_selector, uint8_t channel, void *buffer, uint16_t length,
+                                  tuh_xfer_t *xfer) {
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX && entity_id != 0 && request != 0, false);
+  TU_VERIFY(direction == TUSB_DIR_OUT || direction == TUSB_DIR_IN, false);
+  TU_VERIFY(buffer != NULL || length == 0, false);
+  audioh_interface_t *p_audio = &_audioh_itf[idx];
+  TU_VERIFY(p_audio->mounted, false);
+
+  const tusb_control_request_t setup = {
+    .bmRequestType_bit = {.recipient = TUSB_REQ_RCPT_INTERFACE, .type = TUSB_REQ_TYPE_CLASS, .direction = direction},
+    .bRequest          = request,
+    .wValue            = tu_htole16(tu_u16(control_selector, channel)),
+    .wIndex            = tu_htole16(tu_u16(entity_id, p_audio->ac_itf_num)),
+    .wLength           = tu_htole16(length),
+  };
+  xfer->daddr   = p_audio->daddr;
+  xfer->ep_addr = 0;
+  xfer->setup   = &setup;
+  xfer->buffer  = buffer;
+  return tuh_control_xfer(xfer);
+}
+
+bool tuh_audio_control_xfer(uint8_t idx, uint8_t entity_id, tusb_dir_t direction, uint8_t request,
+                            uint8_t control_selector, uint8_t channel, void *buffer, uint16_t length,
+                            tuh_xfer_cb_t complete_cb, uintptr_t user_data) {
+  tuh_xfer_t xfer = {.complete_cb = complete_cb, .user_data = user_data};
+  return audioh_control_submit(idx, entity_id, direction, request, control_selector, channel, buffer, length, &xfer);
+}
+
+tusb_xfer_result_t tuh_audio_control_xfer_sync(uint8_t idx, uint8_t entity_id, tusb_dir_t direction, uint8_t request,
+                                               uint8_t control_selector, uint8_t channel, void *buffer, uint16_t length,
+                                               uint32_t *actual_len) {
+  if (actual_len != NULL) {
+    *actual_len = 0;
+  }
+
+  tuh_xfer_t xfer = {0};
+  if (!audioh_control_submit(idx, entity_id, direction, request, control_selector, channel, buffer, length, &xfer)) {
+    return XFER_RESULT_TIMEOUT;
+  }
+
+  if (actual_len != NULL) {
+    *actual_len = xfer.actual_len;
+  }
+  return xfer.result;
+}
+
+// Continue a master-volume request across logical channels. Driver-owned
+// request state is released before the final application callback so another
+// Feature Unit request can be submitted from that callback.
+static void audioh_fu_set_complete(tuh_xfer_t *xfer) {
+  const uint8_t        idx     = (uint8_t)xfer->user_data;
+  audioh_interface_t  *p_audio = &_audioh_itf[idx];
+  audioh_ctrl_state_t *ctrl    = &p_audio->ctrl;
+
+  if (xfer->result == XFER_RESULT_SUCCESS && ctrl->fu.control.channel < ctrl->fu.control.last_channel) {
+    tuh_audio_stream_t *s = (tuh_audio_stream_t *)ctrl->value;
+    ctrl->fu.control.channel++;
+    const uint8_t request_code = audioh_control_cur_request(p_audio->protocol, TUSB_DIR_OUT);
+    tuh_xfer_t    next_xfer    = {.complete_cb = audioh_fu_set_complete, .user_data = (uintptr_t)idx};
+    if (audioh_control_submit(idx, s->feature_unit_id, TUSB_DIR_OUT, request_code, AUDIO10_FU_CTRL_VOLUME,
+                              ctrl->fu.control.channel, audioh_fu_ctrl(&_audioh_epbuf[idx]), 2, &next_xfer)) {
+      return;
+    }
+    xfer->result = XFER_RESULT_FAILED;
+  }
+
+  tuh_xfer_cb_t app_cb    = ctrl->complete_cb;
+  uintptr_t     user_data = ctrl->user_data;
+  ctrl->complete_cb       = NULL;
+  ctrl->fu_busy           = false;
+  ctrl->value             = NULL;
+
+  xfer->user_data = user_data;
+  if (app_cb != NULL) {
+    app_cb(xfer);
+  }
+}
+
+static void audioh_fu_value_store(audioh_ctrl_state_t *ctrl, audioh_epbuf_t *epbuf) {
+  if (ctrl->fu.control.value_type == AUDIOH_FU_VALUE_BOOL) {
+    *((bool *)ctrl->value) = audioh_fu_ctrl(epbuf)[0] != 0;
+  } else {
+    const uint16_t value      = tu_le16toh(tu_unaligned_read16(audioh_fu_ctrl(epbuf)));
+    *((int16_t *)ctrl->value) = (int16_t)value;
+  }
+}
+
+// Convert the driver-owned response before releasing the request state and
+// invoking the application callback.
+static void audioh_fu_get_complete(tuh_xfer_t *xfer) {
+  const uint8_t        idx       = (uint8_t)xfer->user_data;
+  audioh_ctrl_state_t *ctrl      = &_audioh_itf[idx].ctrl;
+  audioh_epbuf_t      *epbuf     = &_audioh_epbuf[idx];
+  tuh_xfer_cb_t        app_cb    = ctrl->complete_cb;
+  uintptr_t            user_data = ctrl->user_data;
+  ctrl->complete_cb              = NULL;
+  ctrl->fu_busy                  = false;
+
+  if (ctrl->value != NULL && xfer->result == XFER_RESULT_SUCCESS) {
+    if (xfer->actual_len == ctrl->fu.control.width) {
+      audioh_fu_value_store(ctrl, epbuf);
+    } else {
+      xfer->result = XFER_RESULT_FAILED;
+    }
+  }
+
+  xfer->user_data = user_data;
+  if (app_cb != NULL) {
+    app_cb(xfer);
+  }
+}
+
+enum {
+  AUDIOH_VOLUME_RANGE_MIN,
+  AUDIOH_VOLUME_RANGE_MAX,
+  AUDIOH_VOLUME_RANGE_RES,
+  AUDIOH_VOLUME_RANGE_COUNT
+};
+
+static uint8_t audioh_fu_volume_range_request(uint8_t step) {
+  switch (step) {
+    case AUDIOH_VOLUME_RANGE_MIN:
+      return AUDIO10_CS_REQ_GET_MIN;
+    case AUDIOH_VOLUME_RANGE_MAX:
+      return AUDIO10_CS_REQ_GET_MAX;
+    case AUDIOH_VOLUME_RANGE_RES:
+      return AUDIO10_CS_REQ_GET_RES;
+    default:
+      return AUDIO10_CS_REQ_UNDEF;
+  }
+}
+
+static void audioh_fu_volume_range_store(tuh_audio_stream_t *s, audioh_ctrl_state_t *ctrl, audioh_epbuf_t *epbuf) {
+  const uint16_t value = tu_le16toh(tu_unaligned_read16(audioh_fu_ctrl(epbuf)));
+  switch (ctrl->fu.mount.range_step) {
+    case AUDIOH_VOLUME_RANGE_MIN:
+      s->volume_range.min = (int16_t)value;
+      break;
+    case AUDIOH_VOLUME_RANGE_MAX:
+      s->volume_range.max = (int16_t)value;
+      break;
+    case AUDIOH_VOLUME_RANGE_RES:
+      s->volume_range.res = value;
+      break;
+    default:
+      break;
+  }
+}
+
+static void audioh_mount_feature_unit_complete(tuh_xfer_t *xfer);
+
+static bool audioh_mount_feature_unit_submit(uint8_t idx) {
+  audioh_interface_t  *p_audio = &_audioh_itf[idx];
+  audioh_ctrl_state_t *ctrl    = &p_audio->ctrl;
+  audioh_epbuf_t      *epbuf   = &_audioh_epbuf[idx];
+  tuh_audio_stream_t  *s       = audioh_get_stream_by_idx_unchecked(p_audio, ctrl->fu.mount.stream_idx);
+
+  const bool                   uac2     = p_audio->protocol == AUDIO_INT_PROTOCOL_CODE_V2;
+  const uint8_t                selector = uac2 ? AUDIO20_FU_CTRL_VOLUME : AUDIO10_FU_CTRL_VOLUME;
+  const tusb_control_request_t request  = {
+    .bmRequestType_bit = {.recipient = TUSB_REQ_RCPT_INTERFACE, .type = TUSB_REQ_TYPE_CLASS, .direction = TUSB_DIR_IN},
+    .bRequest          = uac2 ? AUDIO20_CS_REQ_RANGE : audioh_fu_volume_range_request(ctrl->fu.mount.range_step),
+    .wValue            = tu_htole16(tu_u16(selector, s->volume_range_channel)),
+    .wIndex            = tu_htole16(tu_u16(s->feature_unit_id, p_audio->ac_itf_num)),
+    .wLength           = tu_htole16(uac2 ? 8u : 2u),
+  };
+  tuh_xfer_t xfer = {.daddr       = p_audio->daddr,
+                     .ep_addr     = 0,
+                     .setup       = &request,
+                     .buffer      = audioh_fu_ctrl(epbuf),
+                     .complete_cb = audioh_mount_feature_unit_complete,
+                     .user_data   = (uintptr_t)idx};
+  return tuh_control_xfer(&xfer);
+}
+
+static void audioh_mount_feature_unit_next(uint8_t idx) {
+  audioh_interface_t  *p_audio = &_audioh_itf[idx];
+  audioh_ctrl_state_t *ctrl    = &p_audio->ctrl;
+
+  while (ctrl->fu.mount.stream_idx < p_audio->stream_count) {
+    tuh_audio_stream_t *s = audioh_get_stream_by_idx_unchecked(p_audio, ctrl->fu.mount.stream_idx);
+    if (s->volume_range_channel != TUSB_INDEX_INVALID_8) {
+      s->volume_range           = (tuh_audio_volume_range_t){0};
+      ctrl->fu.mount.range_step = AUDIOH_VOLUME_RANGE_MIN;
+      ctrl->fu_busy             = true;
+      if (audioh_mount_feature_unit_submit(idx)) {
+        return;
+      }
+      s->volume_master_access         = AUDIOH_CTRL_NONE;
+      s->volume_range_channel         = TUSB_INDEX_INVALID_8;
+      s->volume_all_channels_writable = false;
+      if (s->mute_access == AUDIOH_CTRL_NONE) {
+        s->feature_unit_id = 0;
+      }
+      ctrl->fu_busy = false;
+    }
+    ctrl->fu.mount.stream_idx++;
+  }
+
+  p_audio->mounted = true;
+  TU_LOG_DRV("  AUDIO mounted: addr = %u index = %u\r\n", p_audio->daddr, idx);
+  tuh_audio_mount_cb(idx);
+  usbh_driver_set_config_complete(p_audio->daddr, p_audio->ac_itf_num);
+}
+
+static void audioh_mount_feature_unit_complete(tuh_xfer_t *xfer) {
+  const uint8_t        idx     = (uint8_t)xfer->user_data;
+  audioh_interface_t  *p_audio = &_audioh_itf[idx];
+  audioh_ctrl_state_t *ctrl    = &p_audio->ctrl;
+  audioh_epbuf_t      *epbuf   = &_audioh_epbuf[idx];
+  if (!ctrl->fu_busy) {
+    return;
+  }
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx_unchecked(p_audio, ctrl->fu.mount.stream_idx);
+
+  const bool uac2 = p_audio->protocol == AUDIO_INT_PROTOCOL_CODE_V2;
+  if (uac2 && xfer->result == XFER_RESULT_SUCCESS && xfer->actual_len == 8 &&
+      tu_le16toh(tu_unaligned_read16(audioh_fu_ctrl(epbuf))) == 1) {
+    uint8_t *fu_ctrl    = audioh_fu_ctrl(epbuf);
+    s->volume_range.min = (int16_t)tu_le16toh(tu_unaligned_read16(&fu_ctrl[2]));
+    s->volume_range.max = (int16_t)tu_le16toh(tu_unaligned_read16(&fu_ctrl[4]));
+    s->volume_range.res = tu_le16toh(tu_unaligned_read16(&fu_ctrl[6]));
+    if (s->volume_range.min > s->volume_range.max || s->volume_range.res == 0) {
+      xfer->result = XFER_RESULT_FAILED;
+    }
+  } else if (!uac2 && xfer->result == XFER_RESULT_SUCCESS && xfer->actual_len == 2) {
+    audioh_fu_volume_range_store(s, ctrl, epbuf);
+    ctrl->fu.mount.range_step++;
+
+    if (ctrl->fu.mount.range_step < AUDIOH_VOLUME_RANGE_COUNT) {
+      if (audioh_mount_feature_unit_submit(idx)) {
+        return;
+      }
+      xfer->result = XFER_RESULT_FAILED;
+    } else if (s->volume_range.min > s->volume_range.max || s->volume_range.res == 0) {
+      xfer->result = XFER_RESULT_FAILED;
+    }
+  }
+
+  const uint32_t expected_len = uac2 ? 8u : 2u;
+  if (xfer->result != XFER_RESULT_SUCCESS || xfer->actual_len != expected_len) {
+    s->volume_master_access         = AUDIOH_CTRL_NONE;
+    s->volume_range_channel         = TUSB_INDEX_INVALID_8;
+    s->volume_all_channels_writable = false;
+    s->volume_range                 = (tuh_audio_volume_range_t){0};
+    if (s->mute_access == AUDIOH_CTRL_NONE) {
+      s->feature_unit_id = 0;
+    }
+  }
+  ctrl->fu_busy = false;
+  ctrl->fu.mount.stream_idx++;
+  audioh_mount_feature_unit_next(idx);
+}
+
+static bool audioh_fu_set(uint8_t idx, uint8_t stream_idx, uint8_t control_selector, uint8_t channel,
+                          uint8_t last_channel, uint16_t value, uint8_t width, tuh_xfer_cb_t complete_cb,
+                          uintptr_t user_data) {
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[idx];
+  TU_VERIFY(p_audio->mounted, false);
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && s->feature_unit_id != 0, false);
+  if (control_selector == AUDIO10_FU_CTRL_MUTE) {
+    TU_VERIFY(channel == 0 && last_channel == 0 && s->mute_access == AUDIOH_CTRL_READ_WRITE, false);
+  } else if (control_selector == AUDIO10_FU_CTRL_VOLUME) {
+    TU_VERIFY(s->volume_range_channel != TUSB_INDEX_INVALID_8 && channel <= last_channel, false);
+    if (channel == 0) {
+      TU_VERIFY(last_channel == 0 && s->volume_master_access == AUDIOH_CTRL_READ_WRITE, false);
+    } else {
+      TU_VERIFY(last_channel <= s->feature_unit_channels, false);
+      TU_VERIFY(channel == last_channel || s->volume_all_channels_writable, false);
+    }
+  }
+
+  const uint8_t request_code = audioh_control_cur_request(p_audio->protocol, TUSB_DIR_OUT);
+  audioh_ctrl_state_t *ctrl  = &p_audio->ctrl;
+  audioh_epbuf_t      *epbuf = &_audioh_epbuf[idx];
+  TU_VERIFY(!ctrl->fu_busy, false);
+  // Reserve both bookkeeping and payload storage before populating the request.
+  ctrl->fu_busy = true;
+
+  uint8_t *val_buf = audioh_fu_ctrl(epbuf);
+  val_buf[0]       = (uint8_t)(value & 0xFF);
+  if (width == 2) {
+    val_buf[1] = (uint8_t)((value >> 8) & 0xFF);
+  }
+
+  if (complete_cb == NULL) {
+    bool result = true;
+    for (uint8_t current_channel = channel; current_channel <= last_channel; current_channel++) {
+      tuh_xfer_t xfer = {.complete_cb = NULL, .user_data = user_data};
+      result          = audioh_control_submit(idx, s->feature_unit_id, TUSB_DIR_OUT, request_code, control_selector,
+                                              current_channel, val_buf, width, &xfer);
+      if (!result || xfer.result != XFER_RESULT_SUCCESS) {
+        break;
+      }
+    }
+    ctrl->fu_busy = false;
+    return result;
+  }
+
+  ctrl->complete_cb             = complete_cb;
+  ctrl->user_data               = user_data;
+  ctrl->value                   = s;
+  ctrl->fu.control.channel      = channel;
+  ctrl->fu.control.last_channel = last_channel;
+  tuh_xfer_t xfer               = {.complete_cb = audioh_fu_set_complete, .user_data = (uintptr_t)idx};
+
+  if (!audioh_control_submit(idx, s->feature_unit_id, TUSB_DIR_OUT, request_code, control_selector, channel, val_buf,
+                             width, &xfer)) {
+    ctrl->complete_cb = NULL;
+    ctrl->value       = NULL;
+    ctrl->fu_busy     = false;
+    return false;
+  }
+  return true;
+}
+
+static bool audioh_fu_get(uint8_t idx, uint8_t stream_idx, uint8_t control_selector, uint8_t channel, void *value,
+                          uint8_t width, uint8_t value_type, tuh_xfer_cb_t complete_cb, uintptr_t user_data) {
+  TU_VERIFY(idx < CFG_TUH_AUDIO_MAX, false);
+  audioh_interface_t *p_audio = &_audioh_itf[idx];
+  TU_VERIFY(p_audio->mounted && value, false);
+  tuh_audio_stream_t *s = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s && s->feature_unit_id != 0, false);
+  if (control_selector == AUDIO10_FU_CTRL_MUTE) {
+    TU_VERIFY(channel == 0 && s->mute_access != AUDIOH_CTRL_NONE, false);
+  } else if (control_selector == AUDIO10_FU_CTRL_VOLUME) {
+    TU_VERIFY(s->volume_range_channel != TUSB_INDEX_INVALID_8, false);
+    if (channel == 0) {
+      TU_VERIFY(s->volume_master_access != AUDIOH_CTRL_NONE, false);
+    } else {
+      TU_VERIFY(channel <= s->feature_unit_channels, false);
+    }
+  }
+
+  const uint8_t request_code = audioh_control_cur_request(p_audio->protocol, TUSB_DIR_IN);
+  audioh_ctrl_state_t *ctrl  = &p_audio->ctrl;
+  audioh_epbuf_t      *epbuf = &_audioh_epbuf[idx];
+  TU_VERIFY(!ctrl->fu_busy, false);
+  ctrl->fu_busy               = true;
+  ctrl->value                 = value;
+  ctrl->fu.control.width      = width;
+  ctrl->fu.control.value_type = value_type;
+
+  if (complete_cb == NULL) {
+    // The synchronous transfer completes before its driver-owned response is
+    // converted to host order.
+    tuh_xfer_t xfer = {.complete_cb = NULL, .user_data = user_data};
+    if (!audioh_control_submit(idx, s->feature_unit_id, TUSB_DIR_IN, request_code, control_selector, channel,
+                               audioh_fu_ctrl(epbuf), width, &xfer)) {
+      ctrl->fu_busy = false;
+      return false;
+    }
+    if (xfer.result == XFER_RESULT_SUCCESS && xfer.actual_len == width) {
+      audioh_fu_value_store(ctrl, epbuf);
+    } else if (xfer.result == XFER_RESULT_SUCCESS && user_data != 0) {
+      *((tusb_xfer_result_t *)user_data) = XFER_RESULT_FAILED;
+    }
+    ctrl->fu_busy = false;
+    return true;
+  }
+
+  // The asynchronous wrapper converts the response before calling the application.
+  ctrl->complete_cb = complete_cb;
+  ctrl->user_data   = user_data;
+  tuh_xfer_t xfer   = {.complete_cb = audioh_fu_get_complete, .user_data = (uintptr_t)idx};
+
+  if (!audioh_control_submit(idx, s->feature_unit_id, TUSB_DIR_IN, request_code, control_selector, channel,
+                             audioh_fu_ctrl(epbuf), width, &xfer)) {
+    ctrl->complete_cb = NULL;
+    ctrl->fu_busy     = false;
+    return false;
+  }
+  return true;
+}
+
+bool tuh_audio_mute_set(uint8_t idx, uint8_t stream_idx, bool mute, tuh_xfer_cb_t complete_cb, uintptr_t user_data) {
+  return audioh_fu_set(idx, stream_idx, AUDIO10_FU_CTRL_MUTE, 0, 0, mute ? 1 : 0, 1, complete_cb, user_data);
+}
+
+bool tuh_audio_mute_get(uint8_t idx, uint8_t stream_idx, bool *mute, tuh_xfer_cb_t complete_cb, uintptr_t user_data) {
+  return audioh_fu_get(idx, stream_idx, AUDIO10_FU_CTRL_MUTE, 0, mute, 1, AUDIOH_FU_VALUE_BOOL, complete_cb, user_data);
+}
+
+static bool audioh_volume_normalize(uint8_t idx, uint8_t stream_idx, int16_t *volume) {
+  tuh_audio_volume_range_t range;
+  TU_VERIFY(tuh_audio_volume_range_get(idx, stream_idx, &range), false);
+  if (*volume != TUH_AUDIO_VOLUME_SILENCE) {
+    TU_VERIFY(*volume >= range.min && *volume <= range.max && range.res != 0, false);
+    const uint32_t offset  = (uint32_t)((int32_t)*volume - range.min);
+    const uint32_t steps   = (offset + range.res / 2u) / range.res;
+    int32_t        rounded = (int32_t)range.min + (int32_t)(steps * range.res);
+    if (rounded > range.max) {
+      rounded -= range.res;
+    }
+    *volume = (int16_t)rounded;
+  }
+  return true;
+}
+
+bool tuh_audio_volume_set(uint8_t idx, uint8_t stream_idx, uint8_t channel, int16_t volume, tuh_xfer_cb_t complete_cb,
+                          uintptr_t user_data) {
+  TU_VERIFY(audioh_volume_normalize(idx, stream_idx, &volume), false);
+  if (channel > 0) {
+    return audioh_fu_set(idx, stream_idx, AUDIO10_FU_CTRL_VOLUME, channel, channel, (uint16_t)volume, 2, complete_cb,
+                         user_data);
+  }
+
+  audioh_interface_t *p_audio = &_audioh_itf[idx];
+  tuh_audio_stream_t *s       = audioh_get_stream_by_idx(p_audio, stream_idx);
+  TU_VERIFY(s != NULL, false);
+  if (s->volume_master_access == AUDIOH_CTRL_READ_WRITE) {
+    return audioh_fu_set(idx, stream_idx, AUDIO10_FU_CTRL_VOLUME, 0, 0, (uint16_t)volume, 2, complete_cb, user_data);
+  }
+  TU_VERIFY(s->feature_unit_channels > 0 && s->volume_all_channels_writable, false);
+  return audioh_fu_set(idx, stream_idx, AUDIO10_FU_CTRL_VOLUME, 1, s->feature_unit_channels, (uint16_t)volume, 2,
+                       complete_cb, user_data);
+}
+
+bool tuh_audio_volume_get(uint8_t idx, uint8_t stream_idx, uint8_t channel, int16_t *volume, tuh_xfer_cb_t complete_cb,
+                          uintptr_t user_data) {
+  return audioh_fu_get(idx, stream_idx, AUDIO10_FU_CTRL_VOLUME, channel, volume, 2, AUDIOH_FU_VALUE_I16, complete_cb,
+                       user_data);
+}
+
+#endif
diff --git a/src/class/audio/audio_host.h b/src/class/audio/audio_host.h
new file mode 100644
index 000000000..95911ab3b
--- /dev/null
+++ b/src/class/audio/audio_host.h
@@ -0,0 +1,361 @@
+/*
+ * SPDX-FileCopyrightText: Copyright (c) 2026 Zhenjiang Zhang
+ * SPDX-FileCopyrightText: Copyright (c) 2026 HiFiPhile (Zixun LI)
+ * SPDX-License-Identifier: MIT
+ *
+ * This file is part of the TinyUSB stack.
+ */
+
+#ifndef TUSB_AUDIO_HOST_H_
+#define TUSB_AUDIO_HOST_H_
+
+#include "audio.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+//--------------------------------------------------------------------+
+// Class Driver Configuration
+//--------------------------------------------------------------------+
+
+// Audio Class protocol versions compiled into the host driver. Multiple
+// versions can be enabled so UAC1 and UAC2 devices can be mounted together.
+#define TUH_AUDIO_PROTOCOL_UAC1 TU_BIT(0)
+#define TUH_AUDIO_PROTOCOL_UAC2 TU_BIT(1)
+
+#ifndef CFG_TUH_AUDIO_PROTOCOLS
+  #define CFG_TUH_AUDIO_PROTOCOLS TUH_AUDIO_PROTOCOL_UAC1
+#endif
+
+#if !(CFG_TUH_AUDIO_PROTOCOLS & (TUH_AUDIO_PROTOCOL_UAC1 | TUH_AUDIO_PROTOCOL_UAC2))
+  #error CFG_TUH_AUDIO_PROTOCOLS must enable UAC1 and/or UAC2
+#endif
+
+#if CFG_TUH_AUDIO_PROTOCOLS & ~(TUH_AUDIO_PROTOCOL_UAC1 | TUH_AUDIO_PROTOCOL_UAC2)
+  #error CFG_TUH_AUDIO_PROTOCOLS contains an unsupported protocol bit
+#endif
+
+// Maximum number of Audio devices
+#ifndef CFG_TUH_AUDIO_MAX
+  #define CFG_TUH_AUDIO_MAX 1
+#endif
+// Maximum discrete sampling frequencies retained per rate source. UAC1 uses
+// one rate source per alternate setting; UAC2 alternate settings may share a
+// Clock Source.
+#ifndef CFG_TUH_AUDIO_MAX_SAM_FREQ
+  #define CFG_TUH_AUDIO_MAX_SAM_FREQ 5
+#endif
+// Maximum supported nonzero-bandwidth Audio Streaming alternate settings per
+// logical stream.
+#ifndef CFG_TUH_AUDIO_MAX_AS
+  #define CFG_TUH_AUDIO_MAX_AS 4
+#endif
+
+// Maximum size of one capture (IN) isochronous transfer the driver submits.
+// Configurations needing a larger per-poll-interval packet are rejected.
+// 256 covers 2-ch 48 kHz S16_LE (192 B) and common endpoint padding (208 B).
+#ifndef CFG_TUH_AUDIO_EPIN_BUFSIZE
+  #define CFG_TUH_AUDIO_EPIN_BUFSIZE 256
+#endif
+
+// Maximum size of one playback (OUT) isochronous transfer the driver submits.
+// Configurations needing a larger per-poll-interval packet are rejected.
+#ifndef CFG_TUH_AUDIO_EPOUT_BUFSIZE
+  #define CFG_TUH_AUDIO_EPOUT_BUFSIZE 256
+#endif
+
+// Depth in bytes of the per-stream data FIFO. The FIFO decouples the
+// application's read/write calls from the endpoint's isochronous polling cadence
+// and absorbs rate differences. Capture overwrites the oldest frames when full.
+// 1024 bytes hold 4 default (256 B) packets.
+#ifndef CFG_TUH_AUDIO_STREAM_BUFSIZE
+  #define CFG_TUH_AUDIO_STREAM_BUFSIZE 1024
+#endif
+
+//--------------------------------------------------------------------+
+// Types
+//--------------------------------------------------------------------+
+
+// Fixed transfer direction of a logical stream.
+typedef enum {
+  TUH_AUDIO_STREAM_PLAYBACK = 0, // Host -> Device (OUT)
+  TUH_AUDIO_STREAM_CAPTURE  = 1, // Device -> Host (IN)
+  TUH_AUDIO_STREAM_DIRECTION_COUNT
+} tuh_audio_direction_t;
+
+// Asynchronous stream operation and transport events.
+typedef enum {
+  TUH_AUDIO_EVENT_START_COMPLETE = 0,
+  TUH_AUDIO_EVENT_STOP_COMPLETE,
+  TUH_AUDIO_EVENT_XFER_FAILED
+} tuh_audio_event_t;
+
+// Discrete Type-I PCM sample format. UAC1 requires bSamFreqType > 0; UAC2
+// configurations are built from the directly connected Clock Source RANGE.
+typedef enum {
+  TUH_AUDIO_FORMAT_S8 = 0,  // signed 8-bit
+  TUH_AUDIO_FORMAT_S16_LE,  // signed 16-bit little-endian
+  TUH_AUDIO_FORMAT_S24_3LE, // signed 24-bit packed in 3 bytes, LE
+  TUH_AUDIO_FORMAT_S24_LE,  // signed 24-bit in 32-bit container, LE
+  TUH_AUDIO_FORMAT_S32_LE,  // signed 32-bit little-endian
+  TUH_AUDIO_FORMAT_COUNT
+} tuh_audio_format_t;
+
+// One complete supported discrete configuration tuple.
+// Each entry is a full (format, sample_rate, channels) combination,
+// avoiding invalid mixes between independent format/rate/channel lists.
+// dir is constant for all configs of a given (dev_idx, stream_idx) and
+// equals the result of tuh_audio_stream_direction().
+typedef struct {
+  uint32_t              sample_rate;
+  tuh_audio_direction_t dir;
+  tuh_audio_format_t    format;
+  uint8_t               channels;
+} tuh_audio_stream_config_t;
+
+// Feature Unit channel zero selects the master channel.
+#define TUH_AUDIO_CHANNEL_MASTER 0
+
+// Volume values are signed 1/256 dB. INT16_MIN represents silence.
+#define TUH_AUDIO_VOLUME_SILENCE INT16_MIN
+
+// One continuous volume range. This matches UAC1 MIN/MAX/RES and the common
+// UAC2 RANGE response containing one subrange.
+typedef struct {
+  int16_t  min;
+  int16_t  max;
+  uint16_t res;
+} tuh_audio_volume_range_t;
+
+// Audio Control descriptors reported during enumeration. Descriptor pointers
+// are valid only for the duration of tuh_audio_descriptor_cb().
+typedef struct {
+  const tusb_desc_interface_t *desc_audio_control;
+  const uint8_t               *desc_cs_audio_control;
+  uint16_t                     desc_cs_audio_control_len;
+} tuh_audio_descriptor_cb_t;
+
+//--------------------------------------------------------------------+
+// Stream Enumeration
+//--------------------------------------------------------------------+
+
+// Number of logical audio streams exposed by one mounted device. The
+// application iterates stream indices [0, tuh_audio_stream_count()) and
+// inspects each with tuh_audio_stream_exists()/tuh_audio_stream_direction().
+uint8_t tuh_audio_stream_count(uint8_t dev_idx);
+
+// True if (dev_idx, stream_idx) identifies an existing stream.
+bool tuh_audio_stream_exists(uint8_t dev_idx, uint8_t stream_idx);
+
+// Fixed transfer direction of the stream.
+tuh_audio_direction_t tuh_audio_stream_direction(uint8_t dev_idx, uint8_t stream_idx);
+
+//--------------------------------------------------------------------+
+// Configuration Enumeration
+//--------------------------------------------------------------------+
+
+// Number of supported discrete configurations of the stream.
+uint8_t tuh_audio_config_count(uint8_t dev_idx, uint8_t stream_idx);
+
+// Active configuration index of the stream, or TUSB_INDEX_INVALID_8 if none.
+uint8_t tuh_audio_active_config(uint8_t dev_idx, uint8_t stream_idx);
+
+// Retrieve one discrete configuration tuple into *config.
+bool tuh_audio_config_get(uint8_t dev_idx, uint8_t stream_idx, uint8_t config_idx, tuh_audio_stream_config_t *config);
+
+//--------------------------------------------------------------------+
+// Configuration (ALSA hw_params analogue)
+//--------------------------------------------------------------------+
+
+// Synchronously configure the stream with the discrete configuration identified by
+// config_idx. The driver:
+//   1. resolves the AS interface and alternate setting,
+//   2. initializes the FIFO and packet scheduler,
+//   3. opens / reconfigures only the selected endpoint.
+bool tuh_audio_configure(uint8_t dev_idx, uint8_t stream_idx, uint8_t config_idx);
+
+//--------------------------------------------------------------------+
+// Stream Control / Frame-based Data
+//--------------------------------------------------------------------+
+
+// Start transferring data with the configuration selected by configure().
+// UAC1 activates the alternate setting before setting an endpoint frequency;
+// UAC2 sets a writable Clock Source before activating the alternate setting.
+// Startup is asynchronous: true means that the first request was submitted.
+// Completion is reported through tuh_audio_event_cb(); no event is emitted
+// when this function returns false.
+bool tuh_audio_start(uint8_t dev_idx, uint8_t stream_idx);
+// Stop transferring and asynchronously deactivate the Audio Streaming
+// interface (alt 0). true means that the deactivation request was submitted.
+// Completion is reported through tuh_audio_event_cb(); no event is emitted
+// when this function returns false.
+bool tuh_audio_stop(uint8_t dev_idx, uint8_t stream_idx);
+
+// Frame-based transfer. One frame = channels * bytes per sample.
+// tuh_audio_write() is valid only for TUH_AUDIO_STREAM_PLAYBACK streams,
+// tuh_audio_read() only for TUH_AUDIO_STREAM_CAPTURE streams.
+// Both functions are non-blocking and return immediately.
+// Returns the number of frames actually written/read (0 on any error,
+// including wrong direction, unconfigured/stopped stream, or full/empty FIFO).
+uint32_t tuh_audio_write(uint8_t dev_idx, uint8_t stream_idx, const void *buffer, uint32_t frame_count);
+uint32_t tuh_audio_read(uint8_t dev_idx, uint8_t stream_idx, void *buffer, uint32_t frame_count);
+
+// Number of frames that can be queued immediately for playback.
+uint32_t tuh_audio_write_available(uint8_t dev_idx, uint8_t stream_idx);
+// Number of captured frames that can be read immediately.
+uint32_t tuh_audio_read_available(uint8_t dev_idx, uint8_t stream_idx);
+
+//--------------------------------------------------------------------+
+// Helpers
+//--------------------------------------------------------------------+
+
+// Container size in bytes of one sample for a given format.
+static inline uint8_t tuh_audio_format_bytes(tuh_audio_format_t format) {
+  switch (format) {
+    case TUH_AUDIO_FORMAT_S8:
+      return 1;
+    case TUH_AUDIO_FORMAT_S16_LE:
+      return 2;
+    case TUH_AUDIO_FORMAT_S24_3LE:
+      return 3;
+    case TUH_AUDIO_FORMAT_S24_LE:
+    case TUH_AUDIO_FORMAT_S32_LE:
+      return 4;
+    default:
+      return 0;
+  }
+}
+
+// Size in bytes of one frame (all channels) for a configuration.
+static inline uint32_t tuh_audio_config_frame_size(const tuh_audio_stream_config_t *config) {
+  TU_ASSERT(config != NULL);
+  return (uint32_t)tuh_audio_format_bytes(config->format) * config->channels;
+}
+
+//--------------------------------------------------------------------+
+// Device Info
+//--------------------------------------------------------------------+
+
+// Check if Audio device is mounted
+bool tuh_audio_mounted(uint8_t idx);
+// Get device address of Audio device
+uint8_t tuh_audio_get_dev_addr(uint8_t idx);
+// True when the stream's Feature Unit supports master mute control.
+bool tuh_audio_mute_supported(uint8_t idx, uint8_t stream_idx);
+// Get the cached volume range. The driver reads the master channel when it
+// supports volume, otherwise the first logical channel with volume control.
+// This typed API assumes logical channels use the same range; applications
+// needing per-channel ranges can use tuh_audio_control_xfer().
+bool tuh_audio_volume_range_get(uint8_t idx, uint8_t stream_idx, tuh_audio_volume_range_t *range);
+
+//--------------------------------------------------------------------+
+// Control Request API
+//--------------------------------------------------------------------+
+
+// Submit a class-specific request to an entity on the Audio Control interface.
+// request is the protocol-specific UAC request code. buffer contains the raw
+// little-endian control payload. For an asynchronous transfer, buffer must
+// remain valid until complete_cb is invoked.
+bool tuh_audio_control_xfer(uint8_t idx, uint8_t entity_id, tusb_dir_t direction, uint8_t request,
+                            uint8_t control_selector, uint8_t channel, void *buffer, uint16_t length,
+                            tuh_xfer_cb_t complete_cb, uintptr_t user_data);
+
+// Master mute and volume controls. Capability and range information is cached
+// before tuh_audio_mount_cb() is invoked. Volume channel 0 selects the master;
+// a SET falls back to writing every logical channel when the master is not
+// writable and all logical channels advertise write access. The completion
+// callback is invoked once after the entire operation. A nonzero volume
+// channel directly selects that 1-based Feature Unit logical channel.
+// Per-channel capability is not cached; an unsupported channel is reported by
+// the control transfer.
+//
+// Volume SET accepts TUH_AUDIO_VOLUME_SILENCE or a value within the cached
+// range; finite values are rounded to the nearest resolution step measured
+// from the range minimum.
+bool tuh_audio_mute_set(uint8_t idx, uint8_t stream_idx, bool mute, tuh_xfer_cb_t complete_cb, uintptr_t user_data);
+bool tuh_audio_mute_get(uint8_t idx, uint8_t stream_idx, bool *mute, tuh_xfer_cb_t complete_cb, uintptr_t user_data);
+bool tuh_audio_volume_set(uint8_t idx, uint8_t stream_idx, uint8_t channel, int16_t volume, tuh_xfer_cb_t complete_cb,
+                          uintptr_t user_data);
+bool tuh_audio_volume_get(uint8_t idx, uint8_t stream_idx, uint8_t channel, int16_t *volume, tuh_xfer_cb_t complete_cb,
+                          uintptr_t user_data);
+
+//--------------------------------------------------------------------+
+// Synchronous control requests block until the transfer completes and return
+// its result. actual_len may be NULL when the received length is not needed.
+// Only use when audio streaming is stopped, otherwise the stream's isochronous
+// transfers may be disrupted and creating audible artifacts !
+//--------------------------------------------------------------------+
+tusb_xfer_result_t tuh_audio_control_xfer_sync(uint8_t idx, uint8_t entity_id, tusb_dir_t direction, uint8_t request,
+                                               uint8_t control_selector, uint8_t channel, void *buffer, uint16_t length,
+                                               uint32_t *actual_len);
+
+TU_ATTR_ALWAYS_INLINE static inline tusb_xfer_result_t tuh_audio_mute_set_sync(uint8_t idx, uint8_t stream_idx,
+                                                                               bool mute) {
+  TU_API_SYNC(tuh_audio_mute_set, idx, stream_idx, mute);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline tusb_xfer_result_t tuh_audio_mute_get_sync(uint8_t idx, uint8_t stream_idx,
+                                                                               bool *mute) {
+  TU_API_SYNC(tuh_audio_mute_get, idx, stream_idx, mute);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline tusb_xfer_result_t tuh_audio_volume_set_sync(uint8_t idx, uint8_t stream_idx,
+                                                                                 uint8_t channel, int16_t volume) {
+  TU_API_SYNC(tuh_audio_volume_set, idx, stream_idx, channel, volume);
+}
+
+TU_ATTR_ALWAYS_INLINE static inline tusb_xfer_result_t tuh_audio_volume_get_sync(uint8_t idx, uint8_t stream_idx,
+                                                                                 uint8_t channel, int16_t *volume) {
+  TU_API_SYNC(tuh_audio_volume_get, idx, stream_idx, channel, volume);
+}
+
+//--------------------------------------------------------------------+
+// Callbacks (Weak is optional)
+//--------------------------------------------------------------------+
+
+// Invoked after the Audio Control and Streaming descriptors have been
+// validated during enumeration, before tuh_audio_mount_cb(). The interface is
+// not mounted yet and control requests must not be submitted from this
+// callback. Applications may inspect or copy descriptors needed for later raw
+// entity control requests.
+void tuh_audio_descriptor_cb(uint8_t idx, const tuh_audio_descriptor_cb_t *desc_cb_data);
+
+// Invoked when device with Audio interface is mounted
+void tuh_audio_mount_cb(uint8_t idx);
+
+// Invoked when device with Audio interface is un-mounted
+void tuh_audio_umount_cb(uint8_t idx);
+
+// Invoked when an isochronous IN transfer completes successfully: the
+// received data is already queued into the stream's capture FIFO.
+void tuh_audio_capture_cb(uint8_t idx, uint8_t stream_idx, uint16_t xferred_bytes);
+
+// Invoked after a successful isochronous OUT transfer, before the next packet
+// is prepared. After this callback returns, the driver submits queued audio
+// from the stream FIFO, or silence when a complete packet is unavailable.
+void tuh_audio_playback_cb(uint8_t idx, uint8_t stream_idx, uint16_t xferred_bytes);
+
+// Reports completion of asynchronous start/stop operations and unrecoverable
+// transfer failures. START_COMPLETE is emitted after the complete activation
+// sequence and initial endpoint transfers are submitted. XFER_FAILED means the
+// HCD could not submit a transfer or completed it unsuccessfully; it is not a
+// notification for an individual dropped isochronous packet. The driver stops
+// the stream before reporting START_COMPLETE failure or XFER_FAILED.
+void tuh_audio_event_cb(uint8_t idx, uint8_t stream_idx, tuh_audio_event_t event, tusb_xfer_result_t result);
+
+//--------------------------------------------------------------------+
+// Internal Class Driver API
+//--------------------------------------------------------------------+
+bool     audioh_init(void);
+bool     audioh_deinit(void);
+uint16_t audioh_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_interface_t *desc_itf, uint16_t max_len);
+bool     audioh_set_config(uint8_t dev_addr, uint8_t itf_num);
+bool     audioh_xfer_cb(uint8_t dev_addr, uint8_t ep_addr, xfer_result_t result, uint32_t xferred_bytes);
+void     audioh_close(uint8_t daddr);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* TUSB_AUDIO_HOST_H_ */
diff --git a/src/class/cdc/cdc_device.c b/src/class/cdc/cdc_device.c
index 56d4aeed9..ed050ad03 100644
--- a/src/class/cdc/cdc_device.c
+++ b/src/class/cdc/cdc_device.c
@@ -323,9 +323,7 @@ uint16_t cdcd_open(uint8_t rhport, const tusb_desc_interface_t* itf_desc, uint16
           tu_edpt_stream_t *stream_tx = &p_cdc->tx_stream;
           tu_edpt_stream_open(stream_tx, rhport, desc_ep, CFG_TUD_CDC_TX_EPSIZE);
 
-  #if CFG_TUD_CDC_TX_PERSISTENT
-          tu_edpt_stream_write_xfer(stream_tx); // flush pending data
-  #else
+  #if !CFG_TUD_CDC_TX_PERSISTENT
           tu_edpt_stream_clear(stream_tx);
   #endif
         } else {
diff --git a/src/class/dfu/dfu_device.c b/src/class/dfu/dfu_device.c
index 006a5bcb7..092abed03 100644
--- a/src/class/dfu/dfu_device.c
+++ b/src/class/dfu/dfu_device.c
@@ -42,9 +42,8 @@ typedef struct {
 
 static dfu_state_ctx_t _dfu_ctx;
 
-#if CFG_TUD_DFU_XFER_BUFSIZE > CFG_TUD_ENDPOINT0_BUFSIZE
-TU_ATTR_ALIGNED(4) uint8_t _transfer_buf[CFG_TUD_DFU_XFER_BUFSIZE];
-#endif
+// Download data must remain valid across the following GETSTATUS control transfer
+TU_ATTR_ALIGNED(4) static uint8_t _transfer_buf[CFG_TUD_DFU_XFER_BUFSIZE];
 
 static void reset_state(void) {
   _dfu_ctx.state = DFU_IDLE;
@@ -52,15 +51,6 @@ static void reset_state(void) {
   _dfu_ctx.flashing_in_progress = false;
 }
 
-static inline uint8_t* get_xfer_buffer(void) {
-  // Use EP0 buffer if it is large enough, otherwise use dedicated buffer
-  #if CFG_TUD_DFU_XFER_BUFSIZE > CFG_TUD_ENDPOINT0_BUFSIZE
-  return _transfer_buf;
-  #else
-  return usbd_get_ctrl_buf();
-  #endif
-}
-
 static bool reply_getstatus(uint8_t rhport, const tusb_control_request_t* request, dfu_state_t state, dfu_status_t status, uint32_t timeout);
 static bool process_download_get_status(uint8_t rhport, uint8_t stage, const tusb_control_request_t* request);
 static bool process_manifest_get_status(uint8_t rhport, uint8_t stage, const tusb_control_request_t* request);
@@ -276,10 +266,10 @@ bool dfu_moded_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control
           TU_VERIFY(_dfu_ctx.attrs & DFU_ATTR_CAN_UPLOAD);
           TU_VERIFY(request->wLength <= CFG_TUD_DFU_XFER_BUFSIZE);
 
-          const uint16_t xfer_len = tud_dfu_upload_cb(_dfu_ctx.alt, request->wValue, get_xfer_buffer(),
+          const uint16_t xfer_len = tud_dfu_upload_cb(_dfu_ctx.alt, request->wValue, _transfer_buf,
                                                       request->wLength);
 
-          return tud_control_xfer(rhport, request, get_xfer_buffer(), xfer_len);
+          return tud_control_xfer(rhport, request, _transfer_buf, xfer_len);
         }
         break;
 
@@ -299,7 +289,7 @@ bool dfu_moded_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control
           if (request->wLength > 0) {
             // Download with payload -> transition to DOWNLOAD SYNC
             _dfu_ctx.state = DFU_DNLOAD_SYNC;
-            return tud_control_xfer(rhport, request, get_xfer_buffer(), request->wLength);
+            return tud_control_xfer(rhport, request, _transfer_buf, request->wLength);
           } else {
             // Download is complete -> transition to MANIFEST SYNC
             _dfu_ctx.state = DFU_MANIFEST_SYNC;
@@ -373,7 +363,7 @@ static bool process_download_get_status(uint8_t rhport, uint8_t stage, const tus
   } else if (stage == CONTROL_STAGE_ACK) {
     if (_dfu_ctx.flashing_in_progress) {
       _dfu_ctx.state = DFU_DNBUSY;
-      tud_dfu_download_cb(_dfu_ctx.alt, _dfu_ctx.block, get_xfer_buffer(), _dfu_ctx.length);
+      tud_dfu_download_cb(_dfu_ctx.alt, _dfu_ctx.block, _transfer_buf, _dfu_ctx.length);
     } else {
       _dfu_ctx.state = DFU_DNLOAD_IDLE;
     }
diff --git a/src/class/midi/midi2_device.c b/src/class/midi/midi2_device.c
index 1d40a2efa..b0a9e2503 100644
--- a/src/class/midi/midi2_device.c
+++ b/src/class/midi/midi2_device.c
@@ -36,6 +36,9 @@ TU_ATTR_WEAK const char* tud_midi2_fb_name_cb(uint8_t itf, uint8_t fb_idx) {
 TU_ATTR_WEAK tud_midi2_stream_result_t tud_midi2_stream_msg_cb(uint8_t itf, const uint32_t* ump_words) {
   (void) itf; (void) ump_words; return MIDI2_STREAM_PASS;
 }
+TU_ATTR_WEAK bool tud_midi2_device_identity_cb(uint8_t itf, tud_midi2_device_identity_t* identity) {
+  (void) itf; (void) identity; return false;
+}
 
 //--------------------------------------------------------------------+
 // Byte order note
@@ -59,6 +62,7 @@ enum {
 enum {
   STREAM_ENDPOINT_DISCOVERY = 0x000,
   STREAM_ENDPOINT_INFO      = 0x001,
+  STREAM_DEVICE_IDENTITY    = 0x002,
   STREAM_EP_NAME            = 0x003,
   STREAM_PROD_INSTANCE_ID   = 0x004,
   STREAM_CONFIG_REQUEST     = 0x005,
@@ -103,6 +107,16 @@ typedef struct {
   uint8_t protocol;
   bool    negotiated;
 
+  // Discovery reply bits waiting for TX FIFO room, drained on TX complete
+  uint8_t nego_pending_ep_filter;
+  uint8_t nego_pending_fb_filter;
+  uint8_t nego_pending_fb_num;    // block requested by the pending discovery, 0xFF = all
+  uint8_t nego_pending_fb_next;   // next block index to reply for
+  bool nego_pending_fb_restart;   // restart after the active FB name when requests merge
+  uint16_t nego_text_status;      // text reply owning nego_text_offset, 0 = none
+  uint16_t nego_text_offset;      // progress into the text reply being sent
+  uint8_t nego_text_index;        // Function Block index for an active FB name
+
   /*------------- From this point, data is not cleared by bus reset -------------*/
   struct {
     midi2d_tx_t      tx;
@@ -327,16 +341,20 @@ static void _nego_send_endpoint_info(midi2d_interface_t* p_midi) {
 // index byte (the Function Block number for FB Name) and 13 chars fit per
 // packet; otherwise the text starts there and 14 chars fit (Endpoint Name,
 // Product Instance Id).
-static void _nego_send_stream_text(midi2d_interface_t* p_midi, uint16_t status,
-                                   bool has_index, uint8_t index, const char* str) {
-  if (!str || str[0] == '\0') return;
+// Sends a stream text from `offset` and returns how far it got. Resuming keeps
+// the End packet, which dropping the tail would lose.
+static uint16_t _nego_send_stream_text(midi2d_interface_t* p_midi, uint16_t status,
+                                       bool has_index, uint8_t index, const char* str,
+                                       uint16_t offset) {
+  if (!str || str[0] == '\0') return 0;
 
-  uint16_t total_len = (uint16_t) strlen(str);
-  uint16_t offset = 0;
+  const uint16_t total_len = (uint16_t) strlen(str);
   const uint8_t per_pkt = has_index ? 13 : 14;
   const uint8_t head_chars = has_index ? 1 : 2;  // chars carried in word0
+  if (offset >= total_len) return total_len;
 
   while (offset < total_len) {
+    if (tu_fifo_remaining(&p_midi->ep_stream.tx.ff) < 16) break;
     uint16_t remaining = total_len - offset;
     uint8_t n = (uint8_t)((remaining > per_pkt) ? per_pkt : remaining);
     bool is_first = (offset == 0);
@@ -370,6 +388,7 @@ static void _nego_send_stream_text(midi2d_interface_t* p_midi, uint16_t status,
     _nego_send_ump(p_midi, msg, 4);
     offset += n;
   }
+  return offset;
 }
 
 static void _nego_send_config_notify(midi2d_interface_t* p_midi, uint8_t protocol) {
@@ -380,6 +399,33 @@ static void _nego_send_config_notify(midi2d_interface_t* p_midi, uint8_t protoco
   _nego_send_ump(p_midi, msg, 4);
 }
 
+static void _nego_send_device_identity(midi2d_interface_t* p_midi) {
+  tud_midi2_device_identity_t id;
+  tu_memclr(&id, sizeof(id));
+  if (!tud_midi2_device_identity_cb(_itf_idx(p_midi), &id)) return;
+
+  // Every field is a run of bytes, each carrying 7 bits, laid out in the same
+  // order as the MIDI 1.0 Device Inquiry reply this message mirrors. A 1-byte
+  // manufacturer ID occupies the first of the three bytes, the other two stay
+  // zero, so the caller passes it as 0x7D0000 and not 0x00007D.
+  uint32_t msg[4] = {0};
+  msg[0] = ((uint32_t) MT_STREAM << 28)
+         | ((uint32_t) STREAM_DEVICE_IDENTITY << 16);
+  msg[1] = id.manufacturer & UINT32_C(0x7F7F7F);
+  // Family and model are 14-bit numbers sent least significant byte first,
+  // as in the Device Inquiry reply. Manufacturer above is a byte sequence
+  // rather than a number, so it keeps its own order.
+  msg[2] = ((uint32_t)  (id.family       & 0x7F) << 24)
+         | ((uint32_t) ((id.family >> 7) & 0x7F) << 16)
+         | ((uint32_t)  (id.model        & 0x7F) << 8)
+         | ((uint32_t) ((id.model  >> 7) & 0x7F));
+  msg[3] = ((uint32_t) ((id.sw_revision >> 24) & 0x7F) << 24)
+         | ((uint32_t) ((id.sw_revision >> 16) & 0x7F) << 16)
+         | ((uint32_t) ((id.sw_revision >>  8) & 0x7F) << 8)
+         | ((uint32_t)  (id.sw_revision        & 0x7F));
+  _nego_send_ump(p_midi, msg, 4);
+}
+
 static void _nego_send_fb_info(midi2d_interface_t* p_midi, uint8_t fb_idx) {
   // Derive direction and group span for this block from the GTB descriptor.
   uint16_t gtb_len = 0;
@@ -395,10 +441,122 @@ static void _nego_send_fb_info(midi2d_interface_t* p_midi, uint8_t fb_idx) {
          | ((uint32_t) fb_idx << 8)
          | _fb_dir_byte(type);  // UI hint + bDirection from the GTB block type
   msg[1] = ((uint32_t) first_group << 24)
-         | ((uint32_t) num_groups << 16);
+         | ((uint32_t) num_groups << 16)
+         | ((uint32_t) (CFG_TUD_MIDI2_FB_CI_VERSION     & 0xFF) << 8)
+         | ((uint32_t) (CFG_TUD_MIDI2_FB_SYSEX8_STREAMS & 0xFF));
   _nego_send_ump(p_midi, msg, 4);
 }
 
+static void _nego_clear_pending(midi2d_interface_t* p_midi) {
+  p_midi->nego_pending_ep_filter = 0;
+  p_midi->nego_pending_fb_filter = 0;
+  p_midi->nego_pending_fb_num = 0;
+  p_midi->nego_pending_fb_next = 0;
+  p_midi->nego_pending_fb_restart = false;
+  p_midi->nego_text_status = 0;
+  p_midi->nego_text_offset = 0;
+  p_midi->nego_text_index = 0;
+}
+
+static const char* _nego_text_cb(midi2d_interface_t* p_midi, uint16_t status, uint8_t index) {
+  const uint8_t itf = _itf_idx(p_midi);
+  switch (status) {
+    case STREAM_EP_NAME:          return tud_midi2_ep_name_cb(itf);
+    case STREAM_PROD_INSTANCE_ID: return tud_midi2_product_id_cb(itf);
+    case STREAM_FB_NAME:          return tud_midi2_fb_name_cb(itf, index);
+    default:                      return NULL;
+  }
+}
+
+// Send or resume one text reply. While it is incomplete, its status and index
+// identify the sole owner of nego_text_offset so another discovery request
+// cannot resume a different string from the same offset.
+static bool _nego_send_text(midi2d_interface_t* p_midi, uint16_t status, uint8_t index) {
+  const char* text = _nego_text_cb(p_midi, status, index);
+  const uint16_t len = text ? (uint16_t) strlen(text) : 0;
+
+  p_midi->nego_text_status = status;
+  p_midi->nego_text_index = index;
+  p_midi->nego_text_offset = _nego_send_stream_text(p_midi, status, status == STREAM_FB_NAME,
+                                                     index, text, p_midi->nego_text_offset);
+  if (p_midi->nego_text_offset < len) return false;
+
+  p_midi->nego_text_status = 0;
+  p_midi->nego_text_offset = 0;
+  p_midi->nego_text_index = 0;
+  return true;
+}
+
+// Send pending discovery replies, one whole reply at a time and only when the
+// TX FIFO can take it. A full-filter Endpoint Discovery asks for more bytes
+// than the default FIFO holds; replies that do not fit stay pending and are
+// retried from the TX complete path, paced by the transfer flow.
+static void _nego_send_pending(midi2d_interface_t* p_midi) {
+  tu_fifo_t* tx_ff = &p_midi->ep_stream.tx.ff;
+
+  // An incomplete text sequence must finish before any newly arrived request
+  // is serviced; otherwise its Continue/End packets could be attached to a
+  // different Endpoint or Function Block string.
+  if (p_midi->nego_text_status) {
+    const uint16_t status = p_midi->nego_text_status;
+    const uint8_t index = p_midi->nego_text_index;
+    if (!_nego_send_text(p_midi, status, index)) return;
+
+    if (status == STREAM_FB_NAME) {
+      if (p_midi->nego_pending_fb_restart) {
+        p_midi->nego_pending_fb_next = 0;
+        p_midi->nego_pending_fb_restart = false;
+      } else {
+        p_midi->nego_pending_fb_next++;
+      }
+    } else {
+      const uint8_t bit = (status == STREAM_EP_NAME) ? 0x04 : 0x08;
+      p_midi->nego_pending_ep_filter &= (uint8_t) ~bit;
+    }
+  }
+
+  while (p_midi->nego_pending_ep_filter) {
+    const uint8_t bit = (uint8_t)(p_midi->nego_pending_ep_filter & (uint8_t)(-p_midi->nego_pending_ep_filter));
+    uint16_t status = 0;
+    switch (bit) {
+      case 0x04: status = STREAM_EP_NAME; break;
+      case 0x08: status = STREAM_PROD_INSTANCE_ID; break;
+      default: break;
+    }
+
+    if (status != 0) {
+      if (!_nego_send_text(p_midi, status, 0)) return;
+    } else {
+      if (tu_fifo_remaining(tx_ff) < 16) return;
+      switch (bit) {
+        case 0x01: _nego_send_endpoint_info(p_midi); break;
+        case 0x02: _nego_send_device_identity(p_midi); break;
+        case 0x10: _nego_send_config_notify(p_midi, p_midi->protocol); break;
+        default: break;
+      }
+    }
+    p_midi->nego_pending_ep_filter &= (uint8_t) ~bit;
+  }
+
+  const uint8_t fb_count = _gtb_block_count(p_midi);
+  while (p_midi->nego_pending_fb_filter && p_midi->nego_pending_fb_next < fb_count) {
+    const uint8_t f = p_midi->nego_pending_fb_next;
+    if (p_midi->nego_pending_fb_num != 0xFF && p_midi->nego_pending_fb_num != f) {
+      p_midi->nego_pending_fb_next++;
+      continue;
+    }
+    if ((p_midi->nego_pending_fb_filter & 0x01) && p_midi->nego_text_offset == 0) {
+      if (tu_fifo_remaining(tx_ff) < 16) return;
+      _nego_send_fb_info(p_midi, f);
+    }
+    if (p_midi->nego_pending_fb_filter & 0x02) {
+      if (!_nego_send_text(p_midi, STREAM_FB_NAME, f)) return;
+    }
+    p_midi->nego_pending_fb_next++;
+  }
+  if (p_midi->nego_pending_fb_next >= fb_count) p_midi->nego_pending_fb_filter = 0;
+}
+
 static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t* words) {
   // Let the application override this message before the built-in responder.
   switch (tud_midi2_stream_msg_cb(_itf_idx(p_midi), words)) {
@@ -421,9 +579,9 @@ static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t*
 
   switch (status) {
     case STREAM_ENDPOINT_DISCOVERY:
-      _nego_send_endpoint_info(p_midi);
-      _nego_send_stream_text(p_midi, STREAM_EP_NAME, false, 0, tud_midi2_ep_name_cb(_itf_idx(p_midi)));
-      _nego_send_stream_text(p_midi, STREAM_PROD_INSTANCE_ID, false, 0, tud_midi2_product_id_cb(_itf_idx(p_midi)));
+      // Filter bitmap: each bit set asks for one individual reply.
+      p_midi->nego_pending_ep_filter |= (uint8_t)(words[1] & 0x1F);
+      _nego_send_pending(p_midi);
       break;
 
     case STREAM_CONFIG_REQUEST: {
@@ -437,14 +595,23 @@ static void _nego_handle_stream_msg(midi2d_interface_t* p_midi, const uint32_t*
     }
 
     case STREAM_FB_DISCOVERY: {
-      uint8_t fb_idx = (words[0] >> 8) & 0xFF;
-      uint8_t filter = words[0] & 0xFF;  // bit 0: FB Info, bit 1: FB Name
-      uint8_t fb_count = _gtb_block_count(p_midi);
-      for (uint8_t f = 0; f < fb_count; f++) {
-        if (fb_idx != 0xFF && fb_idx != f) continue;
-        if (filter & 0x01) _nego_send_fb_info(p_midi, f);
-        if (filter & 0x02) _nego_send_stream_text(p_midi, STREAM_FB_NAME, true, f, tud_midi2_fb_name_cb(_itf_idx(p_midi), f));
+      const uint8_t req_num = (uint8_t)((words[0] >> 8) & 0xFF);
+      const uint8_t req_filter = (uint8_t)(words[0] & 0x03);
+      // Merge with a pending request: repeating a Function Block Info is allowed
+      // at any time, losing a requested one is not.
+      if (req_filter && p_midi->nego_pending_fb_filter) {
+        if (p_midi->nego_pending_fb_num != req_num) p_midi->nego_pending_fb_num = 0xFF;
+        if (p_midi->nego_text_status == STREAM_FB_NAME) {
+          p_midi->nego_pending_fb_restart = true;
+        } else {
+          p_midi->nego_pending_fb_next = 0;
+        }
+      } else if (!p_midi->nego_pending_fb_filter) {
+        p_midi->nego_pending_fb_num = req_num;
+        p_midi->nego_pending_fb_next = 0;
       }
+      p_midi->nego_pending_fb_filter |= req_filter;  // bit 0: FB Info, bit 1: FB Name
+      _nego_send_pending(p_midi);
       break;
     }
 
@@ -754,6 +921,7 @@ bool midi2d_control_xfer_cb(uint8_t rhport, uint8_t stage, const tusb_control_re
 
       tu_edpt_stream_clear(&p_midi->ep_stream.rx);
       tu_fifo_clear(&p_midi->ep_stream.tx.ff);
+      _nego_clear_pending(p_midi);
 
       if (alt == 1) {
         p_midi->negotiated = false;
@@ -824,6 +992,10 @@ bool midi2d_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint3
     }
     tu_edpt_stream_read_xfer(ep_rx);
   } else if (ep_addr == ep_tx->ep_addr && result == XFER_RESULT_SUCCESS) {
+    // Completed transfer freed FIFO room: flush discovery replies still pending.
+    if (p_midi->alt_setting == 1) {
+      _nego_send_pending(p_midi);
+    }
     uint16_t queued = _tx_start_xfer(p_midi);
     // Send ZLP if no more data is queued but the last transfer was exactly mps
     if (queued == 0 && tu_fifo_count(&ep_tx->ff) == 0 && xferred_bytes > 0 &&
diff --git a/src/class/midi/midi2_device.h b/src/class/midi/midi2_device.h
index 171b404b7..e3eb084d9 100644
--- a/src/class/midi/midi2_device.h
+++ b/src/class/midi/midi2_device.h
@@ -58,6 +58,17 @@ extern "C" {
   #define CFG_TUD_MIDI2_PRODUCT_ID  "TinyUSB-MIDI2"
 #endif
 
+// Function Block capabilities reported in Function Block Info Notification.
+// The GTB descriptor carries direction and group span, but not these: they
+// depend on what the application implements, so they default to "none".
+#ifndef CFG_TUD_MIDI2_FB_CI_VERSION
+  #define CFG_TUD_MIDI2_FB_CI_VERSION      0  // 0: none or unknown, 1 or higher: MIDI-CI version
+#endif
+
+#ifndef CFG_TUD_MIDI2_FB_SYSEX8_STREAMS
+  #define CFG_TUD_MIDI2_FB_SYSEX8_STREAMS  0  // 0: unsupported, 1: single, 2-255: simultaneous streams
+#endif
+
 // String descriptor index for the Group Terminal Block (iBlockItem, Table 5-6).
 // 0 = no string descriptor (default, spec-allowed).
 #ifndef CFG_TUD_MIDI2_BLOCK_STRIDX
@@ -118,6 +129,17 @@ typedef enum {
   MIDI2_STREAM_NEGOTIATED_MIDI2,
 } tud_midi2_stream_result_t;
 
+// Device identity fields, as defined for the MIDI 1.0 Device Inquiry reply and
+// reused by the Device Identity Notification. Every byte carries 7 bits.
+// A 1-byte System Exclusive ID goes in the first of the three manufacturer
+// bytes, so 0x7D is passed as 0x7D0000.
+typedef struct {
+  uint32_t manufacturer;   // 3 bytes, first byte is most significant
+  uint16_t family;         // 2 bytes
+  uint16_t model;          // 2 bytes
+  uint32_t sw_revision;    // 4 bytes
+} tud_midi2_device_identity_t;
+
 //--------------------------------------------------------------------+
 // Application Callback API (weak, optional)
 //--------------------------------------------------------------------+
@@ -138,6 +160,12 @@ const uint8_t* tud_midi2_gtb_desc_cb(uint8_t itf, uint16_t* len);
 // discovery. Return NULL or "" for no name.
 const char* tud_midi2_fb_name_cb(uint8_t itf, uint8_t fb_idx);
 
+// Optional device identity, sent as a Device Identity Notification when the
+// host sets the 'd' bit in the Endpoint Discovery filter. Same four fields as
+// the MIDI 1.0 Device Inquiry reply. Return false to skip the notification,
+// which is the default. All values are 7-bit per byte.
+bool tud_midi2_device_identity_cb(uint8_t itf, tud_midi2_device_identity_t* identity);
+
 // Optional: intercept an incoming UMP Stream message (MT 0xF). Return PASS to
 // let the built-in responder handle it, or HANDLED / NEGOTIATED_* if the app
 // answered it (e.g. via tud_midi2_n_ump_write). Lets an app override a single
diff --git a/src/class/mtp/mtp_device.c b/src/class/mtp/mtp_device.c
index 7657899ec..275c9f858 100644
--- a/src/class/mtp/mtp_device.c
+++ b/src/class/mtp/mtp_device.c
@@ -437,8 +437,11 @@ bool mtpd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t
       TU_LOG_DRV("  MTP Data %s CB: xferred_bytes=%lu, xferred_len/total_len=%lu/%lu, is_complete=%d\r\n",
                  is_data_in ? "IN" : "OUT", xferred_bytes, p_mtp->xferred_len, p_mtp->total_len, is_complete ? 1 : 0);
 
-      // Send/queue ZLP if packet is full-sized but transfer is complete
-      if (is_complete && xferred_bytes > 0 && !(xferred_bytes & (threshold - 1))) {
+      // Send/queue ZLP if packet is full-sized but transfer is complete.
+      // OUT must deliver this final payload to the application before receiving
+      // its terminating ZLP below.
+      const bool need_zlp = is_complete && xferred_bytes > 0 && !(xferred_bytes & (threshold - 1));
+      if (is_data_in && need_zlp) {
         TU_LOG_DRV("  queue ZLP\r\n");
         TU_VERIFY(usbd_edpt_claim(p_mtp->rhport, ep_addr));
         TU_ASSERT(usbd_edpt_xfer(p_mtp->rhport, ep_addr, NULL, 0, false));
@@ -466,9 +469,16 @@ bool mtpd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t event, uint32_t
           cb_data.io_container = headerless_packet;
           cb_data.io_container.payload_bytes = xferred_bytes;
         }
-        tud_mtp_data_xfer_cb(&cb_data);
+        if (xferred_bytes > 0) {
+          tud_mtp_data_xfer_cb(&cb_data);
+        }
 
-        if (is_complete) {
+        if (need_zlp) {
+          TU_LOG_DRV("  queue ZLP\r\n");
+          TU_VERIFY(usbd_edpt_claim(p_mtp->rhport, ep_addr));
+          TU_ASSERT(usbd_edpt_xfer(p_mtp->rhport, ep_addr, NULL, 0, false));
+          return true;
+        } else if (is_complete) {
           // back to header + payload for response
           cb_data.io_container = headered_packet;
           cb_data.io_container.header->len = sizeof(mtp_container_header_t);
diff --git a/src/class/net/ncm_device.c b/src/class/net/ncm_device.c
index 84a524f49..72b592787 100644
--- a/src/class/net/ncm_device.c
+++ b/src/class/net/ncm_device.c
@@ -800,31 +800,56 @@ static void tud_network_recv_renew_r(uint8_t rhport) {
 } // tud_network_recv_renew
 
 /**
- * Set the link state and send notification to host
+ * usbd-task trampoline for tud_network_link_state(), packing rhport and is_up
+ * into a single pointer-sized argument.
+ *
+ * Runs entirely in the usbd task context, so it cannot race the notify
+ * xfer-completion callback over the notification state machine. Re-arming
+ * notification_xmit_state and kicking notification_xmit() (rather than
+ * sending NETWORK_CONNECTION directly) means a state change that collides
+ * with an in-flight notification is picked up by the existing completion
+ * callback instead of being silently dropped - which would otherwise leave
+ * the host stuck at NO-CARRIER after a link-state change.
  */
-void tud_network_link_state(uint8_t rhport, bool is_up) {
-  TU_LOG_DRV("tud_network_link_state(%d, %d)\n", rhport, is_up);
+static void ncm_link_state_task(void *param) {
+  uintptr_t const arg = (uintptr_t) param;
+  uint8_t const rhport = (uint8_t) (arg >> 1);
+  bool const is_up = (arg & 1u) != 0;
 
   if (ncm_interface.link_is_up == is_up) {
-    // No change in link state
-    return;
+    return; // no change in link state
   }
 
   ncm_interface.link_is_up = is_up;
 
-  // Only send notification if we have an active data interface
   if (ncm_interface.itf_data_alt != 1) {
-    TU_LOG_DRV("  link state notification skipped (interface not active)\n");
-    return;
+    TU_LOG_DRV("  link state notification deferred (interface not active)\n");
+    return; // data interface not active yet; SET_INTERFACE(alt=1) will notify
   }
 
-  // Reset notification state to send speed change notification first, then link state notification
+  // A link toggle does not change the link speed, so strictly only the
+  // NETWORK_CONNECTION notification would need (re)sending. Re-running the
+  // speed-then-connection sequence keeps this on the same state machine the
+  // completion callback already drives, at the cost of a redundant speed
+  // notification on every toggle.
   ncm_interface.notification_xmit_state = NOTIFICATION_SPEED;
-
-  // Trigger notification transmission
   notification_xmit(rhport, false);
 }
 
+/**
+ * Set the link state and notify the host.
+ *
+ * Defers onto the usbd task so a caller running in a different task than
+ * tud_task() cannot race the notification state machine against the notify
+ * xfer-completion callback.
+ */
+void tud_network_link_state(uint8_t rhport, bool is_up) {
+  TU_LOG_DRV("tud_network_link_state(%d, %d)\n", rhport, is_up);
+
+  uintptr_t const arg = ((uintptr_t) rhport << 1) | (is_up ? 1u : 0u);
+  usbd_defer_func(ncm_link_state_task, (void *) arg, false);
+}
+
 //-----------------------------------------------------------------------------
 //
 // all the netd_*() stuff (interface TinyUSB -> driver)
diff --git a/src/class/usbtmc/usbtmc_device.c b/src/class/usbtmc/usbtmc_device.c
index 07190d89f..0e9978a81 100644
--- a/src/class/usbtmc/usbtmc_device.c
+++ b/src/class/usbtmc/usbtmc_device.c
@@ -497,9 +497,24 @@ bool usbtmcd_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t result, uint
 
 #if (CFG_TUD_USBTMC_ENABLE_488)
           case USBTMC_MSGID_USB488_TRIGGER:
-            // Spec says we halt the EP if we didn't declare we support it.
-            TU_VERIFY(usbtmc_state.capabilities->bmIntfcCapabilities488.supportsTrigger);
-            TU_VERIFY(tud_usbtmc_msg_trigger_cb(msg));
+            // Unlike the messages above, TRIGGER is complete on arrival and has no response, so nothing else
+            // will move us out of STATE_IDLE. Do it here, otherwise the tud_usbtmc_start_bus_read() below (and
+            // any call the application makes from its callback) is a no-op and the bulk-OUT endpoint is left
+            // un-armed, silently timing out every subsequent host transfer.
+            TU_VERIFY(atomicChangeState(STATE_IDLE, STATE_NAK));
+
+            // Spec says we halt the EP if we didn't declare we support it; do the same when the application
+            // rejects the trigger. The callback result must not be wrapped in TU_VERIFY() here: returning
+            // early would skip both the stall and the re-arm below.
+            if (!usbtmc_state.capabilities->bmIntfcCapabilities488.supportsTrigger ||
+                !tud_usbtmc_msg_trigger_cb(msg)) {
+              usbd_edpt_stall(rhport, usbtmc_state.ep_bulk_out);
+              return false;
+            }
+            // Result deliberately ignored: false here means the endpoint is already armed - either the
+            // application re-armed it from its callback, or a transfer is still queued - not that arming
+            // failed. Stalling on it would halt a healthy endpoint.
+            tud_usbtmc_start_bus_read();
 
             break;
 #endif
diff --git a/src/class/usbtmc/usbtmc_device.h b/src/class/usbtmc/usbtmc_device.h
index 3dc700876..efda84f16 100644
--- a/src/class/usbtmc/usbtmc_device.h
+++ b/src/class/usbtmc/usbtmc_device.h
@@ -25,7 +25,6 @@
 // * tud_usbtmc_open_cb
 // * tud_usbtmc_msg_data_cb
 // * tud_usbtmc_msgBulkIn_complete_cb
-// * tud_usbtmc_msg_trigger_cb
 // * (successful) tud_usbtmc_check_abort_bulk_out_cb
 // * (successful) tud_usbtmc_check_abort_bulk_in_cb
 // * (successful) tud_usmtmc_bulkOut_clearFeature_cb
diff --git a/src/class/vendor/vendor_host.c b/src/class/vendor/vendor_host.c
deleted file mode 100644
index dd2c5ac5d..000000000
--- a/src/class/vendor/vendor_host.c
+++ /dev/null
@@ -1,127 +0,0 @@
-/*
- * SPDX-FileCopyrightText: Copyright (c) 2019 Ha Thach (tinyusb.org)
- * SPDX-License-Identifier: MIT
- *
- * This file is part of the TinyUSB stack.
- */
-
-#include "tusb_option.h"
-
-#if (CFG_TUH_ENABLED && CFG_TUH_VENDOR)
-
-//--------------------------------------------------------------------+
-// INCLUDE
-//--------------------------------------------------------------------+
-#include "host/usbh.h"
-#include "vendor_host.h"
-
-//--------------------------------------------------------------------+
-// MACRO CONSTANT TYPEDEF
-//--------------------------------------------------------------------+
-
-//--------------------------------------------------------------------+
-// INTERNAL OBJECT & FUNCTION DECLARATION
-//--------------------------------------------------------------------+
-custom_interface_info_t custom_interface[CFG_TUH_DEVICE_MAX];
-
-static tusb_error_t cush_validate_paras(uint8_t dev_addr, uint16_t vendor_id, uint16_t product_id, void * p_buffer, uint16_t length)
-{
-  if ( !tusbh_custom_is_mounted(dev_addr, vendor_id, product_id) )
-  {
-    return TUSB_ERROR_DEVICE_NOT_READY;
-  }
-
-  TU_ASSERT( p_buffer != NULL && length != 0, TUSB_ERROR_INVALID_PARA);
-
-  return TUSB_ERROR_NONE;
-}
-//--------------------------------------------------------------------+
-// APPLICATION API (need to check parameters)
-//--------------------------------------------------------------------+
-tusb_error_t tusbh_custom_read(uint8_t dev_addr, uint16_t vendor_id, uint16_t product_id, void * p_buffer, uint16_t length)
-{
-  TU_ASSERT_ERR( cush_validate_paras(dev_addr, vendor_id, product_id, p_buffer, length) );
-
-  if ( !hcd_pipe_is_idle(custom_interface[dev_addr-1].pipe_in) )
-  {
-    return TUSB_ERROR_INTERFACE_IS_BUSY;
-  }
-
-  (void) usbh_edpt_xfer( custom_interface[dev_addr-1].pipe_in, p_buffer, length);
-
-  return TUSB_ERROR_NONE;
-}
-
-tusb_error_t tusbh_custom_write(uint8_t dev_addr, uint16_t vendor_id, uint16_t product_id, void const * p_data, uint16_t length)
-{
-  TU_ASSERT_ERR( cush_validate_paras(dev_addr, vendor_id, product_id, p_data, length) );
-
-  if ( !hcd_pipe_is_idle(custom_interface[dev_addr-1].pipe_out) )
-  {
-    return TUSB_ERROR_INTERFACE_IS_BUSY;
-  }
-
-  (void) usbh_edpt_xfer( custom_interface[dev_addr-1].pipe_out, p_data, length);
-
-  return TUSB_ERROR_NONE;
-}
-
-//--------------------------------------------------------------------+
-// USBH-CLASS API
-//--------------------------------------------------------------------+
-void cush_init(void)
-{
-  tu_memclr(&custom_interface, sizeof(custom_interface_info_t) * CFG_TUH_DEVICE_MAX);
-}
-
-tusb_error_t cush_open_subtask(uint8_t dev_addr, tusb_desc_interface_t const *p_interface_desc, uint16_t *p_length)
-{
-  // FIXME quick hack to test lpc1k custom class with 2 bulk endpoints
-  uint8_t const *p_desc = (uint8_t const *) p_interface_desc;
-  p_desc = tu_desc_next(p_desc);
-
-  //------------- Bulk Endpoints Descriptor -------------//
-  for(uint32_t i=0; i<2; i++)
-  {
-    tusb_desc_endpoint_t const *p_endpoint = (tusb_desc_endpoint_t const *) p_desc;
-    TU_ASSERT(TUSB_DESC_ENDPOINT == p_endpoint->bDescriptorType, TUSB_ERROR_INVALID_PARA);
-
-    pipe_handle_t * p_pipe_hdl =  ( p_endpoint->bEndpointAddress &  TUSB_DIR_IN_MASK ) ?
-                         &custom_interface[dev_addr-1].pipe_in : &custom_interface[dev_addr-1].pipe_out;
-    *p_pipe_hdl = usbh_edpt_open(dev_addr, p_endpoint, TUSB_CLASS_VENDOR_SPECIFIC);
-    TU_ASSERT ( pipehandle_is_valid(*p_pipe_hdl), TUSB_ERROR_HCD_OPEN_PIPE_FAILED );
-
-    p_desc = tu_desc_next(p_desc);
-  }
-
-  (*p_length) = sizeof(tusb_desc_interface_t) + 2*sizeof(tusb_desc_endpoint_t);
-  return TUSB_ERROR_NONE;
-}
-
-void cush_isr(pipe_handle_t pipe_hdl, xfer_result_t event)
-{
-
-}
-
-void cush_close(uint8_t dev_addr)
-{
-  tusb_error_t err1, err2;
-  custom_interface_info_t * p_interface = &custom_interface[dev_addr-1];
-
-  // TODO re-consider to check pipe valid before calling pipe_close
-  if( pipehandle_is_valid( p_interface->pipe_in ) )
-  {
-    err1 = hcd_pipe_close( p_interface->pipe_in );
-  }
-
-  if ( pipehandle_is_valid( p_interface->pipe_out ) )
-  {
-    err2 = hcd_pipe_close( p_interface->pipe_out );
-  }
-
-  tu_memclr(p_interface, sizeof(custom_interface_info_t));
-
-  TU_ASSERT(err1 == TUSB_ERROR_NONE && err2 == TUSB_ERROR_NONE, (void) 0 );
-}
-
-#endif
diff --git a/src/class/vendor/vendor_host.h b/src/class/vendor/vendor_host.h
deleted file mode 100644
index dc55663b9..000000000
--- a/src/class/vendor/vendor_host.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * SPDX-FileCopyrightText: Copyright (c) 2019 Ha Thach (tinyusb.org)
- * SPDX-License-Identifier: MIT
- *
- * This file is part of the TinyUSB stack.
- */
-
-#ifndef TUSB_VENDOR_HOST_H_
-#define TUSB_VENDOR_HOST_H_
-
-#include "common/tusb_common.h"
-
-#ifdef __cplusplus
- extern "C" {
-#endif
-
-typedef struct {
-  pipe_handle_t pipe_in;
-  pipe_handle_t pipe_out;
-}custom_interface_info_t;
-
-//--------------------------------------------------------------------+
-// USBH-CLASS DRIVER API
-//--------------------------------------------------------------------+
-static inline bool tusbh_custom_is_mounted(uint8_t dev_addr, uint16_t vendor_id, uint16_t product_id)
-{
-  (void) vendor_id; // TODO check this later
-  (void) product_id;
-//  return (tusbh_device_get_mounted_class_flag(dev_addr) & TU_BIT(TUSB_CLASS_MAPPED_INDEX_END-1) ) != 0;
-  return false;
-}
-
-bool tusbh_custom_read(uint8_t dev_addr, uint16_t vendor_id, uint16_t product_id, void * p_buffer, uint16_t length);
-bool tusbh_custom_write(uint8_t dev_addr, uint16_t vendor_id, uint16_t product_id, void const * p_data, uint16_t length);
-
-//--------------------------------------------------------------------+
-// Internal Class Driver API
-//--------------------------------------------------------------------+
-void cush_init(void);
-bool cush_open_subtask(uint8_t dev_addr, tusb_desc_interface_t const *p_interface_desc, uint16_t *p_length);
-void cush_isr(pipe_handle_t pipe_hdl, xfer_result_t event);
-void cush_close(uint8_t dev_addr);
-
-#ifdef __cplusplus
- }
-#endif
-
-#endif /* TUSB_VENDOR_HOST_H_ */
diff --git a/src/class/video/video_device.c b/src/class/video/video_device.c
index 3797e6b2b..770595178 100644
--- a/src/class/video/video_device.c
+++ b/src/class/video/video_device.c
@@ -1144,6 +1144,9 @@ static int handle_video_stm_cs_req(uint8_t rhport, uint8_t stage,
             video_probe_and_commit_control_t *param = &stm->probe_commit_payload;
             TU_VERIFY(_update_streaming_parameters(stm, param), VIDEO_ERROR_INVALID_VALUE_WITHIN_RANGE);
             /* Set the negotiated value */
+            if (CFG_TUD_VIDEO_STREAMING_EP_BUFSIZE < param->dwMaxPayloadTransferSize) {
+              param->dwMaxPayloadTransferSize = CFG_TUD_VIDEO_STREAMING_EP_BUFSIZE;
+            }
             stm->max_payload_transfer_size = param->dwMaxPayloadTransferSize;
             int ret = tud_video_commit_cb(stm->index_vc, stm->index_vs, param);
             if (VIDEO_ERROR_NONE == ret) {
diff --git a/src/common/tusb_mcu.h b/src/common/tusb_mcu.h
index 93b4a2ee9..af43dfb12 100644
--- a/src/common/tusb_mcu.h
+++ b/src/common/tusb_mcu.h
@@ -126,6 +126,14 @@
     #define CFG_TUSB_MEM_DCACHE_LINE_SIZE_DEFAULT 32
   #endif
 
+  // Errata ERR050101, listed for RT1015/RT1020/RT1024/RT1050 (no fix scheduled) and for
+  // RT1060/RT1064 rev A (fixed in rev B); not listed for RT1010 or the RT11xx family.
+  #if defined(MIMXRT1015_SERIES) || defined(MIMXRT1021_SERIES) || defined(MIMXRT1024_SERIES) || \
+      defined(MIMXRT1051_SERIES) || defined(MIMXRT1052_SERIES) || defined(MIMXRT1061_SERIES) || \
+      defined(MIMXRT1062_SERIES) || defined(MIMXRT1064_SERIES)
+    #define CFG_TUSB_MIMXRT1XXX_ERRATA_ERR050101 1
+  #endif
+
 #elif TU_CHECK_MCU(OPT_MCU_KINETIS_KL, OPT_MCU_KINETIS_K32L, OPT_MCU_KINETIS_K)
   #define TUP_USBIP_CHIPIDEA_FS
   #define TUP_USBIP_CHIPIDEA_FS_KINETIS
@@ -768,6 +776,17 @@
   #define TUP_DCD_EDPT_ISO_ALLOC
 #endif
 
+// Set by silicon whose isochronous IN endpoint can be unprimed by an IN token sent to that same
+// endpoint number on ANOTHER device sharing the host, taking one of this device's OUT endpoints
+// down with it - undetectable in software. Descriptors must then give an isochronous IN endpoint
+// a number no other device on the bus uses; a number is only safe while it stays unique, so two
+// affected boards on one hub must not pick the same one. Default 0 (no such conflict). Set it to
+// 0 by hand on RT1060/RT1064 rev B, which carry the fix - the revision cannot be told apart at
+// compile time, so the affected parts are assumed to be rev A.
+#ifndef CFG_TUSB_MIMXRT1XXX_ERRATA_ERR050101
+  #define CFG_TUSB_MIMXRT1XXX_ERRATA_ERR050101 0
+#endif
+
 // Some USBIPs (SAMG, SAMX7X, PIC32, MAX3266x/MAX78002) cannot assign the same endpoint
 // number to both IN and OUT. Default to 0 (same endpoint number may be used for IN and OUT).
 #ifndef CFG_TUD_ENDPOINT_ONE_DIRECTION_ONLY
diff --git a/src/common/tusb_private.h b/src/common/tusb_private.h
index 0bbc119fd..b91fc0608 100644
--- a/src/common/tusb_private.h
+++ b/src/common/tusb_private.h
@@ -63,7 +63,7 @@ TU_ATTR_ALWAYS_INLINE static inline bool tu_edpt_validate(const tusb_desc_endpoi
 
 // Bind drivers to all interfaces and endpoints in the provided configuration descriptor
 bool tu_bind_driver_to_ep_itf(uint8_t driver_id, uint8_t ep2drv[][2], uint8_t itf2drv[], uint8_t itf_max,
-                              const uint8_t *p_desc, uint16_t desc_len);
+                              uint8_t ep_max, const uint8_t *p_desc, uint16_t desc_len);
 
 // Claim an endpoint with provided mutex
 bool tu_edpt_claim(volatile uint8_t* ep_state, osal_mutex_t mutex);
diff --git a/src/device/dcd.h b/src/device/dcd.h
index f005e9620..a4006ae0c 100644
--- a/src/device/dcd.h
+++ b/src/device/dcd.h
@@ -20,19 +20,27 @@
 // MACRO CONSTANT TYPEDEF PROTYPES
 //--------------------------------------------------------------------+
 
+// Bus reset is reported as two edges. BUS_RESET_START is optional: a controller that
+// cannot tell the edges apart emits only BUS_RESET_END, which stays self-sufficient (it
+// performs the full teardown with or without a preceding START). Emit START when reset
+// signaling is detected - the link is unusable and the speed is not negotiated yet - so
+// the stack stops using endpoints immediately instead of at the end of the reset.
 typedef enum {
-  DCD_EVENT_INVALID = 0,    // 0
-  DCD_EVENT_BUS_RESET,      // 1
-  DCD_EVENT_UNPLUGGED,      // 2
-  DCD_EVENT_SOF,            // 3
-  DCD_EVENT_SUSPEND,        // 4 TODO LPM Sleep L1 support
-  DCD_EVENT_RESUME,         // 5
-  DCD_EVENT_SETUP_RECEIVED, // 6
-  DCD_EVENT_XFER_COMPLETE,  // 7
-  USBD_EVENT_FUNC_CALL,     // 8 Not an DCD event, just a convenient way to defer ISR function
+  DCD_EVENT_INVALID = 0,     // 0
+  DCD_EVENT_BUS_RESET_START, // 1
+  DCD_EVENT_BUS_RESET_END,   // 2 with negotiated speed
+  DCD_EVENT_UNPLUGGED,       // 3
+  DCD_EVENT_SOF,             // 4
+  DCD_EVENT_SUSPEND,         // 5 TODO LPM Sleep L1 support
+  DCD_EVENT_RESUME,          // 6
+  DCD_EVENT_SETUP_RECEIVED,  // 7
+  DCD_EVENT_XFER_COMPLETE,   // 8
+  USBD_EVENT_FUNC_CALL,      // 9 Not an DCD event, just a convenient way to defer ISR function
   DCD_EVENT_COUNT
 } dcd_eventid_t;
 
+#define DCD_EVENT_BUS_RESET DCD_EVENT_BUS_RESET_END // backward compatibility
+
 typedef struct TU_ATTR_ALIGNED(4) {
   uint8_t rhport;
   uint8_t event_id;
diff --git a/src/device/usbd.c b/src/device/usbd.c
index 5471e132d..21d865cf7 100644
--- a/src/device/usbd.c
+++ b/src/device/usbd.c
@@ -456,7 +456,8 @@ TU_ATTR_WEAK bool dcd_configure(uint8_t rhport, uint32_t cfg_id, const void* cfg
 #if CFG_TUSB_DEBUG >= CFG_TUD_LOG_LEVEL
 static char const *const _usbd_event_str[DCD_EVENT_COUNT] = {
     "Invalid",
-    "Bus Reset",
+    "Bus Reset Start",
+    "Bus Reset End",
     "Unplugged",
     "SOF",
     "Suspend",
@@ -642,6 +643,8 @@ static void configuration_reset(uint8_t rhport) {
 
 static void usbd_reset(uint8_t rhport) {
   configuration_reset(rhport);
+  // discard any pre-reset SETUP still counted: a stale count skips post-reset SETUPs
+  _usbd_queued_setup = 0;
 }
 
 bool tud_task_event_ready(void) {
@@ -695,8 +698,15 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
 #endif
 
     switch (event.event_id) {
-      case DCD_EVENT_BUS_RESET:
+      case DCD_EVENT_BUS_RESET_START:
+        TU_LOG_USBD("\r\n");
+        usbd_reset(event.rhport);
+        break;
+
+      case DCD_EVENT_BUS_RESET_END:
         TU_LOG_USBD(": %s Speed\r\n", tu_str_speed[event.bus_reset.speed]);
+        // TODO a DCD that reports both edges pays for two teardowns: track a per-rhport
+        // "start seen" flag and skip this reset, keeping it for the single-event DCDs.
         usbd_reset(event.rhport);
         _usbd_dev.speed = event.bus_reset.speed;
         break;
@@ -747,7 +757,14 @@ void tud_task_ext(uint32_t timeout_ms, bool in_isr) {
         _usbd_dev.ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
 
         if (0 == epnum) {
-          usbd_control_xfer_cb(event.rhport, ep_addr, (xfer_result_t) event.xfer_complete.result, event.xfer_complete.len);
+          // Not stalled on failure: a DCD refuses an EP0 prime when a newer setup is already
+          // latched, and EP0 stalls are cleared by hardware when that setup arrives - so a stall
+          // issued here lands after the auto-clear and would stall the transfer that superseded
+          // this one. The pending setup re-drives EP0 by itself.
+          if (!usbd_control_xfer_cb(event.rhport, ep_addr, (xfer_result_t) event.xfer_complete.result,
+                                    event.xfer_complete.len)) {
+            TU_LOG_USBD("  Control stage not continued\r\n");
+          }
         } else {
           usbd_class_driver_t const* driver = get_driver(_usbd_dev.ep2drv[epnum][ep_dir]);
           TU_ASSERT(driver,);
@@ -865,10 +882,10 @@ bool tud_control_xfer(uint8_t rhport, const tusb_control_request_t* request, voi
     if (ctrl_xfer->data_len > 0U) {
       TU_ASSERT(buffer);
     }
-    TU_ASSERT(data_stage_xact(rhport));
+    TU_VERIFY(data_stage_xact(rhport));
   } else {
     // wLength == 0: Status stage is always IN per USB 2.0 §9.3.1
-    TU_ASSERT(status_stage_xact(rhport, TU_EP0_IN));
+    TU_VERIFY(status_stage_xact(rhport, TU_EP0_IN));
   }
 
   return true;
@@ -919,7 +936,7 @@ static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t
     }
 
     if (is_ok) {
-      TU_ASSERT(status_stage_xact(rhport, ep_status));
+      TU_VERIFY(status_stage_xact(rhport, ep_status));
     } else {
       // Stall both IN and OUT control endpoint
       dcd_edpt_stall(rhport, TU_EP0_OUT);
@@ -927,7 +944,7 @@ static bool usbd_control_xfer_cb(uint8_t rhport, uint8_t ep_addr, xfer_result_t
     }
   } else {
     // More data to transfer
-    TU_ASSERT(data_stage_xact(rhport));
+    TU_VERIFY(data_stage_xact(rhport));
   }
 
   return true;
@@ -1279,8 +1296,8 @@ static bool process_set_config(uint8_t rhport, uint8_t cfg_num) {
         TU_LOG_USBD("  %s opened\r\n", driver->name);
 
         // bind found driver to all interfaces and endpoint within drv_len
-        TU_ASSERT(tu_bind_driver_to_ep_itf(drv_id, _usbd_dev.ep2drv, _usbd_dev.itf2drv, CFG_TUD_INTERFACE_MAX, p_desc,
-                                           drv_len));
+        TU_ASSERT(tu_bind_driver_to_ep_itf(drv_id, _usbd_dev.ep2drv, _usbd_dev.itf2drv, CFG_TUD_INTERFACE_MAX,
+                                           CFG_TUD_ENDPPOINT_MAX, p_desc, drv_len));
 
         p_desc += drv_len; // next Interface
         break; // exit driver find loop
@@ -1473,8 +1490,18 @@ TU_ATTR_FAST_FUNC void dcd_event_handler(dcd_event_t const* event, bool in_isr)
       break;
   }
 
-  if (send) {
-    queue_event(event, in_isr);
+  if (send && !queue_event(event, in_isr)) {
+    // event dropped by a full queue: undo state that would otherwise wedge permanently
+    if (event->event_id == DCD_EVENT_SETUP_RECEIVED) {
+      // undo the increment, else every later SETUP is skipped as "other SETUP in queue"
+      // and EP0 is deaf until re-init
+      _usbd_queued_setup--;
+    } else if (event->event_id == DCD_EVENT_XFER_COMPLETE) {
+      // clear busy + claimed, else the endpoint can never be claimed or re-armed again
+      uint8_t const epnum = tu_edpt_number(event->xfer_complete.ep_addr);
+      uint8_t const ep_dir = tu_edpt_dir(event->xfer_complete.ep_addr);
+      _usbd_dev.ep_status[epnum][ep_dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
+    }
   }
 }
 
@@ -1588,10 +1615,12 @@ bool usbd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t* buffer, uint16_t t
   if (dcd_edpt_xfer(rhport, ep_addr, buffer, total_bytes, is_isr)) {
     return true;
   } else {
-    // DCD error, mark endpoint as ready to allow next transfer
+    // Driver refused the transfer, mark endpoint as ready to allow next transfer. This is a
+    // recoverable condition (e.g. a new setup superseding a control response), not a bug, so
+    // do not break into the debugger - TU_BREAKPOINT() halts the CPU whenever a probe is
+    // attached, which on a test rig is always.
     _usbd_dev.ep_status[epnum][dir] &= (uint8_t) ~(TU_EDPT_STATE_BUSY | TU_EDPT_STATE_CLAIMED);
     TU_LOG_USBD("FAILED\r\n");
-    TU_BREAKPOINT();
     return false;
   }
 }
diff --git a/src/host/usbh.c b/src/host/usbh.c
index e307bb5e5..fd0c9b7b5 100644
--- a/src/host/usbh.c
+++ b/src/host/usbh.c
@@ -258,6 +258,18 @@ static usbh_class_driver_t const usbh_class_drivers[] = {
   },
   #endif
 
+  #if CFG_TUH_AUDIO
+  {
+      .name       = DRIVER_NAME("AUDIO"),
+      .init       = audioh_init,
+      .deinit     = audioh_deinit,
+      .open       = audioh_open,
+      .set_config = audioh_set_config,
+      .xfer_cb    = audioh_xfer_cb,
+      .close      = audioh_close
+  },
+  #endif
+
   #if CFG_TUH_HID
   {
       .name       = DRIVER_NAME("HID"),
@@ -306,17 +318,6 @@ static usbh_class_driver_t const usbh_class_drivers[] = {
   },
   #endif
 
-  #if CFG_TUH_VENDOR
-  {
-    .name       = DRIVER_NAME("VENDOR"),
-    .init       = cush_init,
-    .deinit     = cush_deinit,
-    .open       = cush_open,
-    .set_config = cush_set_config,
-    .xfer_cb    = cush_isr,
-    .close      = cush_close
-  }
-  #endif
 };
 
 // Additional class drivers implemented by application
@@ -397,12 +398,6 @@ TU_ATTR_ALWAYS_INLINE static inline void usbh_device_close(uint8_t rhport, uint8
   _usbh_data.daddr_gen[daddr]++;
   (void) osal_mutex_unlock(_usbh_mutex);
 
-  // If this device has in-flight control xfer, complete as FAILED
-  usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
-  if (daddr == ctrl_info->daddr && ctrl_info->stage != CONTROL_STAGE_IDLE) {
-    control_xfer_complete(daddr, XFER_RESULT_FAILED);
-  }
-
   // invalidate if enumerating
   if (daddr == _usbh_data.enumerating_daddr) {
     _usbh_data.enumerating_daddr = TUSB_INDEX_INVALID_8;
@@ -411,6 +406,12 @@ TU_ATTR_ALWAYS_INLINE static inline void usbh_device_close(uint8_t rhport, uint8
       _usbh_data.call_after.func = NULL;
     }
   }
+
+  // If this device has in-flight control xfer, complete as FAILED
+  usbh_ctrl_xfer_info_t* ctrl_info = &_usbh_data.ctrl_xfer_info;
+  if (daddr == ctrl_info->daddr && ctrl_info->stage != CONTROL_STAGE_IDLE) {
+    control_xfer_complete(daddr, XFER_RESULT_FAILED);
+  }
 }
 
 //--------------------------------------------------------------------+
@@ -1111,7 +1112,10 @@ static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t
             // DATA stage: initial data toggle is always 1
             control_xfer_set_stage(CONTROL_STAGE_DATA);
             const uint8_t ep_data = tu_edpt_addr(0, request->bmRequestType_bit.direction);
-            TU_ASSERT(hcd_edpt_xfer(rhport, daddr, ep_data, ctrl_info->buffer, request->wLength));
+            if (!hcd_edpt_xfer(rhport, daddr, ep_data, ctrl_info->buffer, request->wLength)) {
+              control_xfer_complete(daddr, XFER_RESULT_FAILED);
+              return false;
+            }
             return true;
           }
           TU_ATTR_FALLTHROUGH;
@@ -1126,7 +1130,10 @@ static bool usbh_control_xfer_cb (uint8_t daddr, uint8_t ep_addr, xfer_result_t
             // ACK stage: toggle is always 1
             control_xfer_set_stage(CONTROL_STAGE_ACK);
             const uint8_t ep_status = tu_edpt_addr(0, 1 - request->bmRequestType_bit.direction);
-            TU_ASSERT(hcd_edpt_xfer(rhport, daddr, ep_status, NULL, 0));
+            if (!hcd_edpt_xfer(rhport, daddr, ep_status, NULL, 0)) {
+              control_xfer_complete(daddr, XFER_RESULT_FAILED);
+              return false;
+            }
             break;
           }
 
@@ -1728,8 +1735,10 @@ static void enum_delay_async(uintptr_t state) {
       if (dev0_bus->hub_addr != 0) {
         // connected via hub
         TU_VERIFY(dev0_bus->hub_port != 0, );
-        TU_ASSERT(hub_port_get_status(dev0_bus->hub_addr, dev0_bus->hub_port, NULL, process_enumeration,
-                                      ENUM_HUB_RERSET), );
+        if (!hub_port_get_status(dev0_bus->hub_addr, dev0_bus->hub_port, NULL, process_enumeration,
+                                 ENUM_HUB_RERSET)) {
+          enum_full_complete(false);
+        }
       } else
   #endif
       {
@@ -1772,9 +1781,11 @@ static void enum_delay_async(uintptr_t state) {
     case ENUM_AFTER_RESET_HUB_DELAY:
     case ENUM_AFTER_RESET_HUB_DELAY_RETRY:
       // get status after reset complete to check for reset change
-      TU_ASSERT(hub_port_get_status(dev0_bus->hub_addr, dev0_bus->hub_port, NULL, process_enumeration,
-                                    state == ENUM_AFTER_RESET_HUB_DELAY ? ENUM_HUB_CLEAR_RESET
-                                                                        : ENUM_HUB_CLEAR_RESET_RETRY), );
+      if (!hub_port_get_status(dev0_bus->hub_addr, dev0_bus->hub_port, NULL, process_enumeration,
+                               state == ENUM_AFTER_RESET_HUB_DELAY ? ENUM_HUB_CLEAR_RESET
+                                                                   : ENUM_HUB_CLEAR_RESET_RETRY)) {
+        enum_full_complete(false);
+      }
       break;
   #endif
 
@@ -1787,7 +1798,9 @@ static void enum_delay_async(uintptr_t state) {
       }
       // Get first 8 bytes of device descriptor for control endpoint size
       TU_LOG_USBH("Get 8 byte of Device Descriptor\r\n");
-      TU_ASSERT(tuh_descriptor_get_device(0, _usbh_epbuf.ctrl, 8, process_enumeration, ENUM_SET_ADDR), );
+      if (!tuh_descriptor_get_device(0, _usbh_epbuf.ctrl, 8, process_enumeration, ENUM_SET_ADDR)) {
+        enum_full_complete(false);
+      }
       break;
 
     case ENUM_AFTER_SET_ADDRESS_RECOVERY_DELAY: {
@@ -1796,13 +1809,14 @@ static void enum_delay_async(uintptr_t state) {
       TU_ASSERT(new_dev, );
       if (!usbh_edpt_control_open(new_addr, new_dev->desc_device.bMaxPacketSize0)) {
         TU_LOG_USBH("Failed to open new device's control endpoint\r\n");
-        clear_device(new_dev);
         enum_full_complete(false);
         return;
       }
       TU_LOG_USBH("Get Device Descriptor\r\n");
-      TU_ASSERT(tuh_descriptor_get_device(new_addr, _usbh_epbuf.ctrl, sizeof(tusb_desc_device_t), process_enumeration,
-                                          ENUM_GET_STRING_LANGUAGE_ID_LEN), );
+      if (!tuh_descriptor_get_device(new_addr, _usbh_epbuf.ctrl, sizeof(tusb_desc_device_t), process_enumeration,
+                                     ENUM_GET_STRING_LANGUAGE_ID_LEN)) {
+        enum_full_complete(false);
+      }
       break;
     }
 
@@ -1847,8 +1861,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
         TU_LOG_USBH("Device unplugged from hub while debouncing\r\n");
         is_enum_failed = true;
       } else {
-        TU_ASSERT(hub_port_reset(dev0_bus->hub_addr, dev0_bus->hub_port, process_enumeration,
-                                 ENUM_HUB_RESET_COMPLETE), );
+        is_enum_failed = !hub_port_reset(dev0_bus->hub_addr, dev0_bus->hub_port, process_enumeration,
+                                         ENUM_HUB_RESET_COMPLETE);
       }
       break;
     }
@@ -1865,8 +1879,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
 
       if (1 == port_status.change.reset) {
         // Acknowledge Port Reset Change
-        TU_ASSERT(hub_port_clear_reset_change(dev0_bus->hub_addr, dev0_bus->hub_port, process_enumeration,
-                                              ENUM_HUB_CLEAR_RESET_COMPLETE), );
+        is_enum_failed = !hub_port_clear_reset_change(dev0_bus->hub_addr, dev0_bus->hub_port, process_enumeration,
+                                                       ENUM_HUB_CLEAR_RESET_COMPLETE);
       } else if (state == ENUM_HUB_CLEAR_RESET) {
         // retry one more time if reset change not set yet
         usbh_defer_func_ms_async(ENUM_RESET_HUB_DELAY_MS, enum_delay_async, ENUM_AFTER_RESET_HUB_DELAY_RETRY);
@@ -1911,10 +1925,9 @@ static void process_enumeration(tuh_xfer_t *xfer) {
 
       usbh_device_t* new_dev = get_device(new_addr);
       new_dev->bus_info = *dev0_bus;
-      new_dev->connected = 1;
       new_dev->desc_device.bMaxPacketSize0 = desc_device->bMaxPacketSize0;
 
-      TU_ASSERT(tuh_address_set(0, new_addr, process_enumeration, ENUM_GET_DEVICE_DESC), );
+      is_enum_failed = !tuh_address_set(0, new_addr, process_enumeration, ENUM_GET_DEVICE_DESC);
       break;
     }
 
@@ -1922,6 +1935,7 @@ static void process_enumeration(tuh_xfer_t *xfer) {
       const uint8_t  new_addr = (uint8_t)tu_le16toh(xfer->setup->wValue);
       usbh_device_t *new_dev  = get_device(new_addr);
       TU_ASSERT(new_dev, );
+      new_dev->connected           = 1;
       new_dev->addressed           = 1;
       _usbh_data.enumerating_daddr = new_addr;
 
@@ -1939,15 +1953,15 @@ static void process_enumeration(tuh_xfer_t *xfer) {
       memcpy(&dev->desc_device, (const uint8_t*) desc_device + offsetof(tusb_desc_device_t, bcdUSB), sizeof(desc_device_noheader_t));
 
       tuh_enum_descriptor_device_cb(daddr, desc_device); // callback
-      tuh_descriptor_get_string_langid(daddr, _usbh_epbuf.ctrl, 2,
-                                       process_enumeration, ENUM_GET_STRING_LANGUAGE_ID);
+      is_enum_failed = !tuh_descriptor_get_string_langid(daddr, _usbh_epbuf.ctrl, 2,
+                                                         process_enumeration, ENUM_GET_STRING_LANGUAGE_ID);
       break;
     }
 
     case ENUM_GET_STRING_LANGUAGE_ID: {
       const uint8_t str_len = xfer->buffer[0];
-      tuh_descriptor_get_string_langid(daddr, _usbh_epbuf.ctrl, str_len,
-                                       process_enumeration, ENUM_GET_STRING_MANUFACTURER_LEN);
+      is_enum_failed = !tuh_descriptor_get_string_langid(daddr, _usbh_epbuf.ctrl, str_len,
+                                                         process_enumeration, ENUM_GET_STRING_MANUFACTURER_LEN);
       break;
     }
 
@@ -1957,8 +1971,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
         langid = tu_le16toh(desc_langid->utf16le[0]); // previous request is langid
       }
       if (dev->desc_device.iManufacturer != 0) {
-        tuh_descriptor_get_string(daddr, dev->desc_device.iManufacturer, langid, _usbh_epbuf.ctrl, 2,
-                                  process_enumeration, ENUM_GET_STRING_MANUFACTURER);
+        is_enum_failed = !tuh_descriptor_get_string(daddr, dev->desc_device.iManufacturer, langid, _usbh_epbuf.ctrl, 2,
+                                                    process_enumeration, ENUM_GET_STRING_MANUFACTURER);
         break;
       }
       TU_ATTR_FALLTHROUGH;
@@ -1968,8 +1982,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
       if (dev->desc_device.iManufacturer != 0)  {
         langid = tu_le16toh(xfer->setup->wIndex); // langid from length's request
         const uint8_t str_len = xfer->buffer[0];
-        tuh_descriptor_get_string(daddr, dev->desc_device.iManufacturer, langid, _usbh_epbuf.ctrl, str_len,
-                                  process_enumeration, ENUM_GET_STRING_PRODUCT_LEN);
+        is_enum_failed = !tuh_descriptor_get_string(daddr, dev->desc_device.iManufacturer, langid, _usbh_epbuf.ctrl,
+                                                    str_len, process_enumeration, ENUM_GET_STRING_PRODUCT_LEN);
         break;
       }
       TU_ATTR_FALLTHROUGH;
@@ -1980,8 +1994,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
         if (state == ENUM_GET_STRING_PRODUCT_LEN) {
           langid = tu_le16toh(xfer->setup->wIndex); // get langid from previous setup packet if not fall through
         }
-        tuh_descriptor_get_string(
-            daddr, dev->desc_device.iProduct, langid, _usbh_epbuf.ctrl, 2, process_enumeration, ENUM_GET_STRING_PRODUCT);
+        is_enum_failed = !tuh_descriptor_get_string(daddr, dev->desc_device.iProduct, langid, _usbh_epbuf.ctrl, 2,
+                                                    process_enumeration, ENUM_GET_STRING_PRODUCT);
         break;
       }
       TU_ATTR_FALLTHROUGH;
@@ -1991,8 +2005,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
       if (dev->desc_device.iProduct != 0) {
         langid = tu_le16toh(xfer->setup->wIndex); // langid from length's request
         const uint8_t str_len = xfer->buffer[0];
-        tuh_descriptor_get_string(daddr, dev->desc_device.iProduct, langid, _usbh_epbuf.ctrl, str_len,
-                            process_enumeration, ENUM_GET_STRING_SERIAL_LEN);
+        is_enum_failed = !tuh_descriptor_get_string(daddr, dev->desc_device.iProduct, langid, _usbh_epbuf.ctrl, str_len,
+                                                    process_enumeration, ENUM_GET_STRING_SERIAL_LEN);
         break;
       }
       TU_ATTR_FALLTHROUGH;
@@ -2003,8 +2017,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
         if (state == ENUM_GET_STRING_SERIAL_LEN) {
           langid = tu_le16toh(xfer->setup->wIndex); // get langid from previous setup packet if not fall through
         }
-        tuh_descriptor_get_string(
-            daddr, dev->desc_device.iSerialNumber, langid, _usbh_epbuf.ctrl, 2, process_enumeration, ENUM_GET_STRING_SERIAL);
+        is_enum_failed = !tuh_descriptor_get_string(daddr, dev->desc_device.iSerialNumber, langid, _usbh_epbuf.ctrl, 2,
+                                                    process_enumeration, ENUM_GET_STRING_SERIAL);
         break;
       }
       TU_ATTR_FALLTHROUGH;
@@ -2014,8 +2028,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
       if (dev->desc_device.iSerialNumber != 0) {
         langid = tu_le16toh(xfer->setup->wIndex); // langid from length's request
         const uint8_t str_len = xfer->buffer[0];
-        tuh_descriptor_get_string(daddr, dev->desc_device.iSerialNumber, langid, _usbh_epbuf.ctrl, str_len,
-                                  process_enumeration, ENUM_GET_9BYTE_CONFIG_DESC);
+        is_enum_failed = !tuh_descriptor_get_string(daddr, dev->desc_device.iSerialNumber, langid, _usbh_epbuf.ctrl,
+                                                    str_len, process_enumeration, ENUM_GET_9BYTE_CONFIG_DESC);
         break;
       }
       TU_ATTR_FALLTHROUGH;
@@ -2025,8 +2039,8 @@ static void process_enumeration(tuh_xfer_t *xfer) {
       // Get 9-byte for total length
       uint8_t const config_idx = 0;
       TU_LOG_USBH("Get Configuration[%u] Descriptor (9 bytes)\r\n", config_idx);
-      TU_ASSERT(tuh_descriptor_get_configuration(daddr, config_idx, _usbh_epbuf.ctrl, 9,
-                                                 process_enumeration, ENUM_GET_FULL_CONFIG_DESC),);
+      is_enum_failed = !tuh_descriptor_get_configuration(daddr, config_idx, _usbh_epbuf.ctrl, 9,
+                                                         process_enumeration, ENUM_GET_FULL_CONFIG_DESC);
       break;
     }
 
@@ -2042,21 +2056,21 @@ static void process_enumeration(tuh_xfer_t *xfer) {
       // Get full configuration descriptor
       uint8_t const config_idx = (uint8_t) tu_le16toh(xfer->setup->wIndex);
       TU_LOG_USBH("Get Configuration[%u] Descriptor\r\n", config_idx);
-      TU_ASSERT(tuh_descriptor_get_configuration(daddr, config_idx, _usbh_epbuf.ctrl, total_len,
-                                                 process_enumeration, ENUM_SET_CONFIG),);
+      is_enum_failed = !tuh_descriptor_get_configuration(daddr, config_idx, _usbh_epbuf.ctrl, total_len,
+                                                         process_enumeration, ENUM_SET_CONFIG);
       break;
     }
 
     case ENUM_SET_CONFIG: {
       uint8_t config_idx = (uint8_t) tu_le16toh(xfer->setup->wIndex);
       if (tuh_enum_descriptor_configuration_cb(daddr, config_idx, (const tusb_desc_configuration_t*) _usbh_epbuf.ctrl)) {
-        TU_ASSERT(tuh_configuration_set(daddr, config_idx+1u, process_enumeration, ENUM_CONFIG_DRIVER),);
+        is_enum_failed = !tuh_configuration_set(daddr, config_idx+1u, process_enumeration, ENUM_CONFIG_DRIVER);
       } else {
         config_idx++;
         TU_ASSERT(config_idx < dev->desc_device.bNumConfigurations,);
         TU_LOG_USBH("Get Configuration[%u] Descriptor (9 bytes)\r\n", config_idx);
-        TU_ASSERT(tuh_descriptor_get_configuration(daddr, config_idx, _usbh_epbuf.ctrl, 9,
-                                                   process_enumeration, ENUM_GET_FULL_CONFIG_DESC),);
+        is_enum_failed = !tuh_descriptor_get_configuration(daddr, config_idx, _usbh_epbuf.ctrl, 9,
+                                                           process_enumeration, ENUM_GET_FULL_CONFIG_DESC);
       }
       break;
     }
@@ -2160,7 +2174,8 @@ static bool enum_parse_configuration_desc(uint8_t dev_addr, tusb_desc_configurat
           TU_LOG_USBH("  %s opened\r\n", driver->name);
 
           // bind found driver to all interfaces and endpoint within drv_len
-          tu_bind_driver_to_ep_itf(drv_id, dev->ep2drv, dev->itf2drv, CFG_TUH_INTERFACE_MAX, p_desc, drv_len);
+          TU_ASSERT(tu_bind_driver_to_ep_itf(drv_id, dev->ep2drv, dev->itf2drv, CFG_TUH_INTERFACE_MAX,
+                                             CFG_TUH_ENDPOINT_MAX, p_desc, drv_len));
 
           p_desc += drv_len; // next Interface
           break;             // exit driver find loop
@@ -2210,12 +2225,19 @@ void usbh_driver_set_config_complete(uint8_t dev_addr, uint8_t itf_num) {
 }
 
 static void enum_full_complete(bool success) {
-  (void)success;
   TU_LOG_USBH("Enumeration complete: success = %u\r\n", success);
 
+  const uint8_t daddr = _usbh_data.enumerating_daddr;
   _usbh_data.enumerating_daddr = TUSB_INDEX_INVALID_8; // mark enumeration as complete
   _usbh_data.call_after.func = NULL;
 
+  if (!success && daddr <= TOTAL_DEVICES) {
+    usbh_device_close(_usbh_data.dev0_bus.rhport, daddr);
+    if (daddr > 0) {
+      clear_device(get_device(daddr));
+    }
+  }
+
   #if CFG_TUH_HUB
   // Hub status is already requested in case of successful enumeration
   if (!success && _usbh_data.dev0_bus.hub_addr != 0) {
diff --git a/src/portable/chipidea/ci_hs/ci_hs_imxrt.h b/src/portable/chipidea/ci_hs/ci_hs_imxrt.h
index f0f918fe2..8f0d6083e 100644
--- a/src/portable/chipidea/ci_hs/ci_hs_imxrt.h
+++ b/src/portable/chipidea/ci_hs/ci_hs_imxrt.h
@@ -36,6 +36,9 @@ static const ci_hs_controller_t _ci_controller[] =
 
 #define CI_HS_REG(_port)        ((ci_hs_regs_t*) _ci_controller[_port].reg_base)
 
+// NXP recommends AHBBRST = INCR16 (remainder as unspecified-length bursts)
+#define CI_HS_SET_AHB_BURST(_p)  (CI_HS_REG(_p)->SBUSCFG = SBUSCFG_AHBBRST_INCR16_UNSPEC)
+
 //------------- DCD -------------//
 #define CI_DCD_INT_ENABLE(_p)   NVIC_EnableIRQ ((IRQn_Type)_ci_controller[_p].irqnum)
 #define CI_DCD_INT_DISABLE(_p)  NVIC_DisableIRQ((IRQn_Type)_ci_controller[_p].irqnum)
diff --git a/src/portable/chipidea/ci_hs/ci_hs_lpc18_43.h b/src/portable/chipidea/ci_hs/ci_hs_lpc18_43.h
index f2061bd7a..c7dc7e69f 100644
--- a/src/portable/chipidea/ci_hs/ci_hs_lpc18_43.h
+++ b/src/portable/chipidea/ci_hs/ci_hs_lpc18_43.h
@@ -34,4 +34,9 @@ static const ci_hs_controller_t _ci_controller[] =
 #define CI_HCD_INT_ENABLE(_p)   NVIC_EnableIRQ ((IRQn_Type)_ci_controller[_p].irqnum)
 #define CI_HCD_INT_DISABLE(_p)  NVIC_DisableIRQ((IRQn_Type)_ci_controller[_p].irqnum)
 
+// USB0 (high-speed) only: NXP recommends AHBBRST = INCR16 (remainder as
+// unspecified-length bursts)
+#define CI_HS_SET_AHB_BURST(_p) \
+  do { if ((_p) == 0) { CI_HS_REG(_p)->SBUSCFG = SBUSCFG_AHBBRST_INCR16_UNSPEC; } } while (0)
+
 #endif
diff --git a/src/portable/chipidea/ci_hs/ci_hs_type.h b/src/portable/chipidea/ci_hs/ci_hs_type.h
index 70817a6e3..b3ef3b6af 100644
--- a/src/portable/chipidea/ci_hs/ci_hs_type.h
+++ b/src/portable/chipidea/ci_hs/ci_hs_type.h
@@ -29,6 +29,14 @@ enum {
   USBCMD_INTR_THRESHOLD_MASK = 0x00FF0000u, // Interrupt Threshold bit 23:16
 };
 
+// DEVICEADDR
+#define DEVICEADDR_USBADR_POS 25
+
+enum {
+  DEVICEADDR_USBADRA     = TU_BIT(24),  ///< Device Address Advance: stage USBADR until the next EP0 IN is ACKed
+  DEVICEADDR_USBADR_MASK = 0xFE000000u, ///< Device Address bit 31:25
+};
+
 // PORTSC1
 #define PORTSC1_PORT_SPEED_POS    26
 
@@ -36,10 +44,18 @@ enum {
   PORTSC1_CURRENT_CONNECT_STATUS = TU_BIT(0),
   PORTSC1_FORCE_PORT_RESUME      = TU_BIT(6),
   PORTSC1_SUSPEND                = TU_BIT(7),
+  PORTSC1_PORT_RESET             = TU_BIT(8), // read-only in device mode: a reset is being driven
   PORTSC1_FORCE_FULL_SPEED       = TU_BIT(24),
   PORTSC1_PORT_SPEED             = TU_BIT(26) | TU_BIT(27)
 };
 
+// PORTSC1 PSPD field values, once shifted down by PORTSC1_PORT_SPEED_POS. 3 is undefined.
+enum {
+  PORTSC1_PORT_SPEED_FULL = 0,
+  PORTSC1_PORT_SPEED_LOW  = 1,
+  PORTSC1_PORT_SPEED_HIGH = 2,
+};
+
 // OTGSC
 enum {
   OTGSC_VBUS_DISCHARGE          = TU_BIT(0),
@@ -71,11 +87,18 @@ enum {
   USBMODE_VBUS_POWER_SELECT = TU_BIT(5), // Need to be enabled for LPC18XX/43XX in host mode
 };
 
+// SBUSCFG
+enum {
+  SBUSCFG_AHBBRST_INCR16_UNSPEC = 7, // INCR16 burst, remainder as unspecified-length bursts
+};
+
 // Device Registers
 typedef struct
 {
   //------------- ID + HW Parameter Registers-------------//
-  volatile uint32_t TU_RESERVED[64]; ///< For iMX RT10xx, but not used by LPC18XX/LPC43XX
+  volatile uint32_t TU_RESERVED[36]; ///< ID/HW parameter registers, not used by this driver
+  volatile uint32_t SBUSCFG;         ///< System Bus Interface Configuration (not present on every MCU)
+  volatile uint32_t TU_RESERVED[27];
 
   //------------- Capability Registers-------------//
   volatile uint8_t  CAPLENGTH;       ///< Capability Registers Length
diff --git a/src/portable/chipidea/ci_hs/dcd_ci_hs.c b/src/portable/chipidea/ci_hs/dcd_ci_hs.c
index fa98d6882..f1c333280 100644
--- a/src/portable/chipidea/ci_hs/dcd_ci_hs.c
+++ b/src/portable/chipidea/ci_hs/dcd_ci_hs.c
@@ -154,6 +154,14 @@ TU_VERIFY_STATIC(sizeof(dcd_qhd_t) == 64, "size is not correct");
 
 #define QTD_NEXT_INVALID 0x01
 
+// Bounded spin for register waits. The longest legitimate wait is a flush held off by a packet
+// already in progress: ~50 us for a full-speed 64-byte packet, a low thousands of dependent
+// register reads, so healthy hardware never approaches this bound. Exceeding it means the
+// controller has stopped responding, and the spin then only serves to keep an ISR (or an
+// IRQ-masked caller) from hanging outright - the 3 ms reset-cleanup window of IMXRT1060RM 42.5.6.2.1 (p.2394)
+// is already unreachable in that state, and the manual's remedy there is a controller reset.
+#define CI_HS_BUSY_SPIN 10000u
+
 typedef struct {
   // Must be at 2K alignment
   // Each endpoint with direction (IN/OUT) occupies a queue head
@@ -164,6 +172,17 @@ typedef struct {
 
 CFG_TUD_MEM_SECTION TU_ATTR_ALIGNED(2048) static dcd_data_t _dcd_data;
 
+// What the next Port Change Detect will be. Each one is preceded by the interrupt that causes it:
+// a reset interrupt for the end of a bus reset - where the speed first becomes final - or a
+// suspend interrupt for the resume that ends the suspend. A suspend itself raises no port change,
+// which is why there is no such value here. Indexed by rhport, which is 0 or 1 on every ci_hs
+// variant (NOT the controller count: mcx/rw61x map rhport 1 to controller 0).
+enum {
+  PORT_CHANGE_REASON_RESET  = 0,
+  PORT_CHANGE_REASON_RESUME = 1,
+};
+static volatile uint8_t _port_change_reason[2];
+
 //--------------------------------------------------------------------+
 // Prototypes and Helper Functions
 //--------------------------------------------------------------------+
@@ -172,12 +191,37 @@ TU_ATTR_ALWAYS_INLINE static inline uint8_t ci_ep_count(const ci_hs_regs_t *dcd_
   return dcd_reg->DCCPARAMS & DCCPARAMS_DEN_MASK;
 }
 
+static bool controller_reset(uint8_t rhport);
+
 //--------------------------------------------------------------------+
 // Controller API
 //--------------------------------------------------------------------+
 
-/// follows LPC43xx User Manual 23.10.3
-static void bus_reset(uint8_t rhport) {
+// Flush endpoint buffers, following IMXRT1060RM 42.5.6.6.5 Flushing/De-priming an Endpoint
+// (p.2413): write ENDPTFLUSH, wait for the controller
+// to acknowledge, then confirm ENDPTSTAT went to zero. The controller refuses the flush when a
+// packet is in progress, and the manual requires the procedure be repeated until it takes.
+// Callers proceed regardless of the result; the bound only prevents an ISR-context hang on dead
+// hardware.
+static bool flush_endpoints(ci_hs_regs_t *dcd_reg, uint32_t mask) {
+  uint32_t guard = CI_HS_BUSY_SPIN;
+  do {
+    dcd_reg->ENDPTFLUSH = mask;
+    while (dcd_reg->ENDPTFLUSH & mask) {
+      if (!guard--) {
+        return false;
+      }
+    }
+  } while ((dcd_reg->ENDPTSTAT & mask) && guard--);
+
+  return !(dcd_reg->ENDPTSTAT & mask);
+}
+
+/// Everything the manual asks of the DCD when a reset is detected, in its order: clear the setup
+/// and completion semaphores, cancel every prime, check the reset is still being driven, and free
+/// the dTDs. All of it belongs inside the reset window (IMXRT1060RM 42.5.6.2.1, p.2394); nothing
+/// is left for the port change that ends the reset, which only reports the negotiated speed.
+static void bus_reset_begin(uint8_t rhport) {
   ci_hs_regs_t *dcd_reg = CI_HS_REG(rhport);
 
   // The reset value for all endpoint types is the control endpoint. If one endpoint
@@ -193,17 +237,24 @@ static void bus_reset(uint8_t rhport) {
   //------------- Clear All Registers -------------//
   dcd_reg->ENDPTNAK       = dcd_reg->ENDPTNAK;
   dcd_reg->ENDPTNAKEN     = 0;
-  dcd_reg->USBSTS         = dcd_reg->USBSTS;
   dcd_reg->ENDPTSETUPSTAT = dcd_reg->ENDPTSETUPSTAT;
   dcd_reg->ENDPTCOMPLETE  = dcd_reg->ENDPTCOMPLETE;
 
-  while (dcd_reg->ENDPTPRIME) {}
-  dcd_reg->ENDPTFLUSH = 0xFFFFFFFF;
-  while (dcd_reg->ENDPTFLUSH) {}
+  uint32_t guard = CI_HS_BUSY_SPIN;
+  while (dcd_reg->ENDPTPRIME && guard--) {}
+  dcd_reg->ENDPTFLUSH = 0xFFFFFFFFUL;
 
-  // read reset bit in portsc
+  // All of the above must land while the reset is still being driven - it lasts at least 3 ms.
+  // Arriving late leaves the controller in an undefined state, and the manual's remedy is to
+  // hardware-reset it. That clears Run/Stop, so the device detaches and the host will drive a
+  // fresh reset and enumeration - which is why nothing below this point is worth doing here.
+  if (!(dcd_reg->PORTSC1 & PORTSC1_PORT_RESET)) {
+    TU_LOG1("ci_hs: reset cleanup ran past the end of the reset, resetting controller\r\n");
+    controller_reset(rhport);
+    return; // the controller detached; the host's next reset redoes everything below
+  }
 
-  //------------- Queue Head & Queue TD -------------//
+  //------------- Free all allocated dTDs: the controller will not execute them again -------------//
   tu_memclr(&_dcd_data, sizeof(dcd_data_t));
 
   //------------- Set up Control Endpoints (0 OUT, 1 IN) -------------//
@@ -216,27 +267,29 @@ static void bus_reset(uint8_t rhport) {
   dcd_dcache_clean_invalidate(&_dcd_data, sizeof(dcd_data_t));
 }
 
-bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
-  (void)rh_init;
-  tu_memclr(&_dcd_data, sizeof(dcd_data_t));
-
+/// Reset the controller and bring it back up in device mode. Also the manual's remedy when the
+/// reset cleanup misses its window: the controller reset clears Run/Stop and detaches the device,
+/// so it must be re-initialised completely afterwards (IMXRT1060RM 42.5.6.2.1, p.2394).
+static bool controller_reset(uint8_t rhport) {
   ci_hs_regs_t *dcd_reg = CI_HS_REG(rhport);
 
-  TU_ASSERT(ci_ep_count(dcd_reg) <= TUP_DCD_ENDPOINT_MAX);
-
-  #if TU_CHECK_MCU(OPT_MCU_HPM)
-  usb_phy_init((USB_Type *)dcd_reg, false);
-  #endif
+  tu_memclr(&_dcd_data, sizeof(dcd_data_t));
 
   // Reset controller
   dcd_reg->USBCMD |= USBCMD_RESET;
-  while (dcd_reg->USBCMD & USBCMD_RESET) {}
+  uint32_t guard = CI_HS_BUSY_SPIN;
+  while ((dcd_reg->USBCMD & USBCMD_RESET) && guard--) {}
+  TU_VERIFY(!(dcd_reg->USBCMD & USBCMD_RESET)); // reached from the ISR too, so never halt here
 
   // Set mode to device, must be set immediately after reset
   uint32_t usbmode = dcd_reg->USBMODE & ~USBMOD_CM_MASK;
   usbmode |= USBMODE_CM_DEVICE;
   dcd_reg->USBMODE = usbmode;
 
+  #ifdef CI_HS_SET_AHB_BURST
+  CI_HS_SET_AHB_BURST(rhport);
+  #endif
+
   #ifdef CFG_TUD_CI_HS_VBUS_CHARGE
   dcd_reg->OTGSC = OTGSC_VBUS_CHARGE | OTGSC_OTG_TERMINATION;
   #else
@@ -253,9 +306,11 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
 
   dcd_dcache_clean_invalidate(&_dcd_data, sizeof(dcd_data_t));
 
+  _port_change_reason[rhport] = PORT_CHANGE_REASON_RESET;
+
   dcd_reg->ENDPTLISTADDR = (uint32_t)_dcd_data.qhd; // Endpoint List Address has to be 2K alignment
   dcd_reg->USBSTS        = dcd_reg->USBSTS;
-  dcd_reg->USBINTR       = INTR_USB | INTR_ERROR | INTR_PORT_CHANGE | INTR_SUSPEND;
+  dcd_reg->USBINTR       = INTR_USB | INTR_ERROR | INTR_PORT_CHANGE | INTR_RESET | INTR_SUSPEND;
 
   uint32_t usbcmd = dcd_reg->USBCMD;
   usbcmd &= ~USBCMD_INTR_THRESHOLD_MASK; // Interrupt Threshold Interval = 0
@@ -266,8 +321,22 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
   return true;
 }
 
+bool dcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
+  (void)rh_init;
+  ci_hs_regs_t *dcd_reg = CI_HS_REG(rhport);
+
+  TU_ASSERT(ci_ep_count(dcd_reg) <= TUP_DCD_ENDPOINT_MAX);
+
+  #if TU_CHECK_MCU(OPT_MCU_HPM)
+  usb_phy_init((USB_Type *)dcd_reg, false);
+  #endif
+
+  return controller_reset(rhport);
+}
+
 bool dcd_deinit(uint8_t rhport) {
   ci_hs_regs_t* dcd_reg = CI_HS_REG(rhport);
+  _port_change_reason[rhport] = PORT_CHANGE_REASON_RESET;
 
   // disable all interrupt
   dcd_reg->USBINTR = 0;
@@ -276,9 +345,9 @@ bool dcd_deinit(uint8_t rhport) {
   dcd_reg->USBCMD &= ~USBCMD_RUN_STOP;
 
   // flush all endpoints
-  while (dcd_reg->ENDPTPRIME) {}
-  dcd_reg->ENDPTFLUSH = 0xFFFFFFFF;
-  while (dcd_reg->ENDPTFLUSH) {}
+  uint32_t guard = CI_HS_BUSY_SPIN;
+  while (dcd_reg->ENDPTPRIME && guard--) {}
+  flush_endpoints(dcd_reg, 0xFFFFFFFF);
 
   return true;
 }
@@ -292,11 +361,18 @@ void dcd_int_disable(uint8_t rhport) {
 }
 
 void dcd_set_address(uint8_t rhport, uint8_t dev_addr) {
-  // Response with status first before changing device address
-  dcd_edpt_xfer(rhport, tu_edpt_addr(0, TUSB_DIR_IN), NULL, 0, false);
+  ci_hs_regs_t  *dcd_reg = CI_HS_REG(rhport);
+  const uint32_t prev    = dcd_reg->DEVICEADDR & DEVICEADDR_USBADR_MASK;
 
-  ci_hs_regs_t *dcd_reg = CI_HS_REG(rhport);
-  dcd_reg->DEVICEADDR   = (dev_addr << 25) | TU_BIT(24);
+  // IMXRT1060RM 42.7.23 / UM10503 Table 478: stage the address before priming the status stage so
+  // hardware loads USBADR at the status ACK. Priming first races that ACK against this write.
+  dcd_reg->DEVICEADDR = ((uint32_t)dev_addr << DEVICEADDR_USBADR_POS) | DEVICEADDR_USBADRA;
+
+  if (!dcd_edpt_xfer(rhport, tu_edpt_addr(0, TUSB_DIR_IN), NULL, 0, false)) {
+    // USB 2.0 9.4.6: the address changes only after the status stage completes successfully. The
+    // status never went out, so drop the stage - USBADRA=0 takes effect instantly.
+    dcd_reg->DEVICEADDR = prev;
+  }
 }
 
 void dcd_remote_wakeup(uint8_t rhport) {
@@ -464,9 +540,7 @@ bool dcd_edpt_iso_activate(uint8_t rhport, const tusb_desc_endpoint_t *desc_ep)
   // dcd_dcache_clean_invalidate(&_dcd_data, sizeof(dcd_data_t));
 
   // Flush EP
-  const uint32_t flush_mask = TU_BIT(epnum + (dir ? 16 : 0));
-  dcd_reg->ENDPTFLUSH       = flush_mask;
-  while (dcd_reg->ENDPTFLUSH & flush_mask) {}
+  flush_endpoints(dcd_reg, TU_BIT(epnum + (dir ? 16 : 0)));
 
   // disable to change max packet size
   ep_ctrl_clear(endptctrl, dir, ENDPTCTRL_ENABLE);
@@ -492,7 +566,7 @@ void dcd_edpt_close_all(uint8_t rhport) {
   }
 }
 
-static void qhd_start_xfer(uint8_t rhport, uint8_t epnum, uint8_t dir) {
+static bool qhd_start_xfer(uint8_t rhport, uint8_t epnum, uint8_t dir) {
   ci_hs_regs_t *dcd_reg = CI_HS_REG(rhport);
   dcd_qhd_t    *p_qhd   = &_dcd_data.qhd[epnum][dir];
   dcd_qtd_t    *p_qtd   = &_dcd_data.qtd[epnum][dir];
@@ -505,13 +579,22 @@ static void qhd_start_xfer(uint8_t rhport, uint8_t epnum, uint8_t dir) {
   dcd_dcache_clean_invalidate(&_dcd_data, sizeof(dcd_data_t));
 
   if (epnum == 0) {
-    // follows UM 24.10.8.1.1 Setup packet handling using setup lockout mechanism
-    // wait until ENDPTSETUPSTAT before priming data/status in response TODO add time out
-    while (dcd_reg->ENDPTSETUPSTAT & TU_BIT(0)) {}
+    // Setup lockout (IMXRT1060RM 42.5.6.4.2.1 Setup Phase, p.2403): never prime EP0 while a new
+    // SETUP is pending. The ISR
+    // normally consumes ENDPTSETUPSTAT quickly; if the guard trips, fail the transfer so usbd
+    // releases the endpoint (a pending SETUP supersedes this response anyway; without one, usbd
+    // stalls EP0 and the host recovers with a fresh control transfer).
+    uint32_t guard = CI_HS_BUSY_SPIN;
+    while (dcd_reg->ENDPTSETUPSTAT & TU_BIT(0)) {
+      if (!guard--) {
+        return false;
+      }
+    }
   }
 
   // start transfer
   dcd_reg->ENDPTPRIME = TU_BIT(epnum + (dir ? 16 : 0));
+  return true;
 }
 
 bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_t total_bytes, bool is_isr) {
@@ -527,9 +610,7 @@ bool dcd_edpt_xfer(uint8_t rhport, uint8_t ep_addr, uint8_t *buffer, uint16_t to
 
   // Start qhd transfer
   p_qhd->ff = NULL;
-  qhd_start_xfer(rhport, epnum, dir);
-
-  return true;
+  return qhd_start_xfer(rhport, epnum, dir);
 }
 
   #if !CFG_TUD_MEM_DCACHE_ENABLE
@@ -580,9 +661,7 @@ bool dcd_edpt_xfer_fifo(uint8_t rhport, uint8_t ep_addr, tu_fifo_t *ff, uint16_t
 
   // Start qhd transfer
   p_qhd->ff = ff;
-  qhd_start_xfer(rhport, epnum, dir);
-
-  return true;
+  return qhd_start_xfer(rhport, epnum, dir);
 }
   #endif
 
@@ -630,43 +709,43 @@ void dcd_int_handler(uint8_t rhport) {
     return;
   }
 
-  // Set if the port controller enters the full or high-speed operational state.
-  // either from Bus Reset or Suspended state
-  if (int_status & INTR_PORT_CHANGE) {
-    // TU_LOG2("PortChange %08lx\r\n", dcd_reg->PORTSC1);
+  const uint8_t pci_reason = _port_change_reason[rhport]; // save current pci_reason
 
-    // Reset interrupt is not enabled, we manually check if Port Change is due
-    // to connection / disconnection
-    if (dcd_reg->USBSTS & INTR_RESET) {
-      dcd_reg->USBSTS = INTR_RESET;
-
-      if (dcd_reg->PORTSC1 & PORTSC1_CURRENT_CONNECT_STATUS) {
-        const uint32_t speed = (dcd_reg->PORTSC1 & PORTSC1_PORT_SPEED) >> PORTSC1_PORT_SPEED_POS;
-        bus_reset(rhport);
-        dcd_event_bus_reset(rhport, (tusb_speed_t)speed, true);
-      } else {
-        dcd_event_bus_signal(rhport, DCD_EVENT_UNPLUGGED, true);
-      }
-    } else {
-      // Triggered by resuming from suspended state
-      if (!(dcd_reg->PORTSC1 & PORTSC1_SUSPEND)) {
-        dcd_event_bus_signal(rhport, DCD_EVENT_RESUME, true);
-      }
-    }
+  if (int_status & INTR_SUSPEND) {
+    _port_change_reason[rhport] = PORT_CHANGE_REASON_RESUME; // next PCI is resume
+    dcd_event_bus_signal(rhport, DCD_EVENT_SUSPEND, true);
   }
 
-  if (int_status & INTR_SUSPEND) {
-    // TU_LOG2("Suspend %08lx\r\n", dcd_reg->PORTSC1);
+  // USB Reset Received: register cleanup runs here within the reset window (IMXRT1060RM 42.5.6.2.1, p.2394)
+  // and BUS_RESET_START fires now; BUS_RESET_END, with the final speed, is triggered later by PCI.
+  if (int_status & INTR_RESET) {
+    _port_change_reason[rhport] = PORT_CHANGE_REASON_RESET;
+    bus_reset_begin(rhport);
+    dcd_event_bus_signal(rhport, DCD_EVENT_BUS_RESET_START, true);
+  }
 
-    if (dcd_reg->PORTSC1 & PORTSC1_SUSPEND) {
-      // Note: Host may delay more than 3 ms before and/or after bus reset before doing enumeration.
-      // Skip suspend event if we are not addressed
-      if ((dcd_reg->DEVICEADDR >> 25) & 0x0f) {
-        dcd_event_bus_signal(rhport, DCD_EVENT_SUSPEND, true);
-      }
+  // Port entered the full/high-speed operational state: the end of a bus reset, or a resume.
+  if (int_status & INTR_PORT_CHANGE) {
+    if (pci_reason == PORT_CHANGE_REASON_RESUME) {
+      dcd_event_bus_signal(rhport, DCD_EVENT_RESUME, true);
+    } else {
+      // the undefined encoding falls back to full speed
+      const uint32_t pspd = (dcd_reg->PORTSC1 & PORTSC1_PORT_SPEED) >> PORTSC1_PORT_SPEED_POS;
+      const tusb_speed_t speed = (pspd == PORTSC1_PORT_SPEED_LOW)    ? TUSB_SPEED_LOW :
+                                 (pspd == PORTSC1_PORT_SPEED_HIGH)   ? TUSB_SPEED_HIGH : TUSB_SPEED_FULL;
+      dcd_event_bus_reset(rhport, speed, true);
+      // This reset is over, so the next port change is a resume. Leaving it at RESET instead would
+      // dispatch every later resume as another end-of-reset, clearing the queue heads mid-session.
+      _port_change_reason[rhport] = PORT_CHANGE_REASON_RESUME;
     }
   }
 
+  // No unplug detection yet, by the manual rather than by omission: IMXRT1060RM 42.7.31 (p.2470) says a zero
+  // Current Connect Status means the device "did not attach successfully or was forcibly
+  // disconnected by the software writing a zero to the Run bit ... It does not state the device
+  // being disconnected or suspended", so a cable pull raises no port change at all. VBUS via
+  // OTGSC BSV is the manual's disconnect indicator, and it is board dependent.
+
   if (int_status & INTR_USB) {
     // Make sure we read the latest version of _dcd_data.
     dcd_dcache_clean_invalidate(&_dcd_data, sizeof(dcd_data_t));
@@ -674,7 +753,7 @@ void dcd_int_handler(uint8_t rhport) {
     const uint32_t edpt_complete = dcd_reg->ENDPTCOMPLETE;
     dcd_reg->ENDPTCOMPLETE       = edpt_complete; // acknowledge
 
-    // 23.10.12.3 Failed QTD also get ENDPTCOMPLETE set
+    // 42.5.6.6.4 Transfer Completion (p.2413): a failed dTD also sets ENDPTCOMPLETE
     // nothing to do, we will submit xfer as error to usbd
     // if (int_status & INTR_ERROR) { }
 
@@ -690,12 +769,39 @@ void dcd_int_handler(uint8_t rhport) {
     }
 
     // Set up Received
-    // 23.10.10.2 Operational model for setup transfers
+    // 42.5.6.4.2 Control Endpoint Operation Model (p.2403)
     // Must be after normal transfer complete since it is possible to have both previous control status + new setup
     // in the same frame and we should handle previous status first.
     if (dcd_reg->ENDPTSETUPSTAT) {
+      // 42.5.6.4.2.1 Setup Phase (p.2403) steps 1-2: duplicate the setup payload BEFORE clearing
+      // ENDPTSETUPSTAT -
+      // the clear releases the setup lockout and a back-to-back SETUP (usbtest case 10) can
+      // overwrite the queue-head buffer immediately after. The copy is read through the volatile
+      // qualifier rather than memcpy'd because C orders volatile accesses only against each
+      // other: a plain copy may legally be sunk past the lockout-releasing store below.
+      union {
+        tusb_control_request_t request;
+        uint8_t byte[8];
+      } setup;
+      const volatile uint8_t *setup_src = (const volatile uint8_t *)&_dcd_data.qhd[0][0].setup_request;
+      for (uint8_t i = 0; i < sizeof(setup.request); i++) {
+        setup.byte[i] = setup_src[i];
+      }
       dcd_reg->ENDPTSETUPSTAT = dcd_reg->ENDPTSETUPSTAT;
-      dcd_event_setup_received(rhport, (uint8_t *)(uintptr_t)&_dcd_data.qhd[0][0].setup_request, true);
+
+      // Retire a status/handshake phase left primed by the previous control sequence
+      // (IMXRT1060RM 42.5.6.4.2.1, p.2403), which would otherwise retire the response the task is about to
+      // prime for this setup. Skipped when EP0 has nothing primed or priming, since the manual
+      // does not want the flush wait in an interrupt handler when it has nothing to do.
+      // One volatile read per statement: C leaves their order unspecified within a single
+      // expression, which IAR rejects outright (Pa082).
+      const uint32_t ep0_mask  = TU_BIT(0) | TU_BIT(16);
+      const uint32_t ep0_stat  = dcd_reg->ENDPTSTAT;
+      const uint32_t ep0_prime = dcd_reg->ENDPTPRIME;
+      if ((ep0_stat | ep0_prime) & ep0_mask) {
+        flush_endpoints(dcd_reg, ep0_mask);
+      }
+      dcd_event_setup_received(rhport, setup.byte, true);
     }
   }
 
diff --git a/src/portable/chipidea/ci_hs/hcd_ci_hs.c b/src/portable/chipidea/ci_hs/hcd_ci_hs.c
index 3cb69acfa..0f24f5bb6 100644
--- a/src/portable/chipidea/ci_hs/hcd_ci_hs.c
+++ b/src/portable/chipidea/ci_hs/hcd_ci_hs.c
@@ -82,6 +82,10 @@ bool hcd_init(uint8_t rhport, const tusb_rhport_init_t *rh_init) {
   hcd_reg->USBMODE = USBMODE_CM_HOST;
   #endif
 
+  #ifdef CI_HS_SET_AHB_BURST
+  CI_HS_SET_AHB_BURST(rhport);
+  #endif
+
   #if !TUH_OPT_HIGH_SPEED
   hcd_reg->PORTSC1 |= PORTSC1_FORCE_FULL_SPEED;
   #endif
diff --git a/src/portable/nxp/lpc_ip3511/dcd_lpc_ip3511.c b/src/portable/nxp/lpc_ip3511/dcd_lpc_ip3511.c
index d5b03e4b1..42f6750b1 100644
--- a/src/portable/nxp/lpc_ip3511/dcd_lpc_ip3511.c
+++ b/src/portable/nxp/lpc_ip3511/dcd_lpc_ip3511.c
@@ -87,6 +87,10 @@ enum {
   DEVCMDSTAT_SUSPEND_CHANGE_MASK = TU_BIT(25),
   DEVCMDSTAT_RESET_CHANGE_MASK   = TU_BIT(26),
   DEVCMDSTAT_VBUS_DEBOUNCED_MASK = TU_BIT(28),
+
+  // write-1-to-clear latches
+  DEVCMDSTAT_W1C_MASK            = DEVCMDSTAT_SETUP_RECEIVED_MASK | DEVCMDSTAT_CONNECT_CHANGE_MASK |
+                                   DEVCMDSTAT_SUSPEND_CHANGE_MASK | DEVCMDSTAT_RESET_CHANGE_MASK,
 };
 
 enum {
@@ -171,7 +175,9 @@ typedef struct
   ep_cmd_sts_t ep[2*MAX_EP_PAIRS][2];
   xfer_dma_t dma[2*MAX_EP_PAIRS];
 
-  TU_ATTR_ALIGNED(64) uint8_t setup_packet[8];
+  // volatile: the controller DMAs a new setup packet into this buffer as soon as the SETUP
+  // latch is cleared, so reads of it must stay ordered against the register accesses around them
+  TU_ATTR_ALIGNED(64) volatile uint8_t setup_packet[8];
 }dcd_data_t;
 
 // EP list must be 256-byte aligned
@@ -180,8 +186,12 @@ typedef struct
 //    Use CFG_TUD_MEM_SECTION to place it accordingly.
 CFG_TUD_MEM_SECTION TU_ATTR_ALIGNED(256) static dcd_data_t _dcd;
 
-// Dummy buffer to fix ZLPs overwriting the buffer (probably an USB/DMA controller bug)
-// TODO find way to save memory
+// Dummy buffer to fix ZLPs overwriting the buffer: Errata LPC55S6x USB.5 / LPC55S2x USB.4 - the
+// HS device controller always DMA-writes OUT data in 8-byte units, so up to 7 bytes land past the
+// received length. This redirects the ZLP case; the general short-OUT case is unhandled here
+// (TinyUSB's own endpoint buffers are sized/aligned so the spill stays inside them, but a tight
+// caller buffer can be overrun by up to 7 bytes - the SDK's documented workaround is a bounce
+// buffer). TODO find way to save memory
 CFG_TUD_MEM_SECTION TU_ATTR_ALIGNED(64) static uint8_t dummy[8];
 
 //--------------------------------------------------------------------+
@@ -221,7 +231,7 @@ static const dcd_controller_t _dcd_controller[] = {
 // INTERNAL OBJECT & FUNCTION DECLARATION
 //--------------------------------------------------------------------+
 
-TU_ATTR_ALWAYS_INLINE static inline uint16_t get_buf_offset(void const * buffer) {
+TU_ATTR_ALWAYS_INLINE static inline uint16_t get_buf_offset(void const volatile * buffer) {
   uint32_t addr = (uint32_t) buffer;
   TU_ASSERT( (addr & 0x3f) == 0, 0 );
   return ( (addr >> 6) & 0xFFFFUL ) ;
@@ -247,6 +257,16 @@ TU_ATTR_ALWAYS_INLINE static inline bool rhport_is_highspeed(uint8_t rhport) {
   return _dcd_controller[rhport].is_highspeed;
 }
 
+
+// DEVCMDSTAT mixes RW fields with write-1-to-clear latches (SETUP + the 3 change bits): a blind
+// RMW writes a pending latch back as 1 and silently clears it (a SETUP eaten this way strands
+// EP0). Mask the latches on every update; pass one in set_mask only to clear it.
+TU_ATTR_ALWAYS_INLINE static inline void devcmdstat_update(dcd_registers_t* dcd_reg,
+                                                           uint32_t clear_mask, uint32_t set_mask) {
+  const uint32_t v = dcd_reg->DEVCMDSTAT & ~(DEVCMDSTAT_W1C_MASK | clear_mask);
+  dcd_reg->DEVCMDSTAT = v | set_mask;
+}
+
 //--------------------------------------------------------------------+
 // CONTROLLER API
 //--------------------------------------------------------------------+
@@ -284,8 +304,10 @@ bool dcd_init(uint8_t rhport, const tusb_rhport_init_t* rh_init) {
   dcd_reg->DATABUFSTART = tu_align((uint32_t) &_dcd, TU_BIT(22)); // 22-bit alignment
   dcd_reg->INTSTAT      = dcd_reg->INTSTAT; // clear all pending interrupt
   dcd_reg->INTEN        = INT_DEVICE_STATUS_MASK;
-  dcd_reg->DEVCMDSTAT  |= DEVCMDSTAT_DEVICE_ENABLE_MASK | DEVCMDSTAT_DEVICE_CONNECT_MASK |
-                           DEVCMDSTAT_RESET_CHANGE_MASK | DEVCMDSTAT_CONNECT_CHANGE_MASK | DEVCMDSTAT_SUSPEND_CHANGE_MASK;
+  // deliberately clear every latch (incl. a SETUP left by a bootloader/warm start) for a
+  // deterministic init state
+  devcmdstat_update(dcd_reg, 0, DEVCMDSTAT_DEVICE_ENABLE_MASK | DEVCMDSTAT_DEVICE_CONNECT_MASK |
+                    DEVCMDSTAT_W1C_MASK);
 
   NVIC_ClearPendingIRQ(_dcd_controller[rhport].irqnum);
 
@@ -309,8 +331,7 @@ void dcd_set_address(uint8_t rhport, uint8_t dev_addr)
   // Response with status first before changing device address
   dcd_edpt_xfer(rhport, tu_edpt_addr(0, TUSB_DIR_IN), NULL, 0, false);
 
-  dcd_reg->DEVCMDSTAT &= ~DEVCMDSTAT_DEVICE_ADDR_MASK;
-  dcd_reg->DEVCMDSTAT |= dev_addr;
+  devcmdstat_update(dcd_reg, DEVCMDSTAT_DEVICE_ADDR_MASK, dev_addr);
 }
 
 void dcd_remote_wakeup(uint8_t rhport)
@@ -321,13 +342,13 @@ void dcd_remote_wakeup(uint8_t rhport)
 void dcd_connect(uint8_t rhport)
 {
   dcd_registers_t* dcd_reg = _dcd_controller[rhport].regs;
-  dcd_reg->DEVCMDSTAT |= DEVCMDSTAT_DEVICE_CONNECT_MASK;
+  devcmdstat_update(dcd_reg, 0, DEVCMDSTAT_DEVICE_CONNECT_MASK);
 }
 
 void dcd_disconnect(uint8_t rhport)
 {
   dcd_registers_t* dcd_reg = _dcd_controller[rhport].regs;
-  dcd_reg->DEVCMDSTAT &= ~DEVCMDSTAT_DEVICE_CONNECT_MASK;
+  devcmdstat_update(dcd_reg, DEVCMDSTAT_DEVICE_CONNECT_MASK, 0);
 }
 
 void dcd_sof_enable(uint8_t rhport, bool en)
@@ -380,9 +401,17 @@ void dcd_edpt_clear_stall(uint8_t rhport, uint8_t ep_addr)
 
   uint8_t const ep_id = ep_addr2id(ep_addr);
 
+  // Preserve rf_tv: for non-control endpoints it is a TYPE bit, not the toggle value (UM11126:
+  // T=1 + RF 1/0 = interrupt/iso). Zeroing it here turned HS periodic interrupt endpoints into
+  // isochronous - no handshake on OUT, dead IN (usbtest cases 25/26 on lpc55 HS port).
+  // TODO implement the Errata LPC546xx USB.13 work-around (same semantics in UM11126): with RF/TV preserved at 1, TR
+  // loads the toggle from TV, so an HS interrupt endpoint restarts on DATA1 after clear-halt and
+  // the host discards one packet as a retransmission. The documented workaround needs an
+  // interrupt-on-NAK state machine (park as generic TR=1/TV=0, wait for a NAKed token to latch
+  // toggle 0 via EPTOGGLE, restore the type) - deferred; one lost packet beats the fully broken
+  // endpoint the old rf_tv clear caused.
   _dcd.ep[ep_id][0].cmd_sts.stall        = 0;
   _dcd.ep[ep_id][0].cmd_sts.toggle_reset = 1;
-  _dcd.ep[ep_id][0].cmd_sts.rf_tv        = 0;
 }
 
 bool dcd_edpt_open(uint8_t rhport, tusb_desc_endpoint_t const * p_endpoint_desc)
@@ -432,7 +461,7 @@ void dcd_edpt_close_all (uint8_t rhport)
 {
   for (uint8_t ep_id = 0; ep_id < 2*_dcd_controller[rhport].ep_pairs; ++ep_id)
   {
-    _dcd.ep[ep_id][0].cmd_sts.active = _dcd.ep[ep_id][0].cmd_sts.active = 0; // TODO proper way is to EPSKIP then wait ep[][].active then write ep[][].disable (see table 778 in LPC55S69 Use Manual)
+    _dcd.ep[ep_id][0].cmd_sts.active = _dcd.ep[ep_id][1].cmd_sts.active = 0; // TODO proper way is to EPSKIP then wait ep[][].active then write ep[][].disable (see table 778 in LPC55S69 Use Manual)
     _dcd.ep[ep_id][0].cmd_sts.disable = _dcd.ep[ep_id][1].cmd_sts.disable = 1;
   }
 }
@@ -538,7 +567,7 @@ static void bus_reset(uint8_t rhport)
   dcd_reg->EPSKIP       = 0xFFFFFFFF;
 
   dcd_reg->INTSTAT      = dcd_reg->INTSTAT;                               // clear all pending interrupt
-  dcd_reg->DEVCMDSTAT  |= DEVCMDSTAT_SETUP_RECEIVED_MASK;                    // clear setup received interrupt
+  devcmdstat_update(dcd_reg, 0, DEVCMDSTAT_SETUP_RECEIVED_MASK);          // clear setup received interrupt
   dcd_reg->INTEN        = INT_DEVICE_STATUS_MASK | TU_BIT(0) | TU_BIT(1); // enable device status & control endpoints
 }
 
@@ -597,18 +626,25 @@ void dcd_int_handler(uint8_t rhport)
 {
   dcd_registers_t* dcd_reg = _dcd_controller[rhport].regs;
 
-  uint32_t const cmd_stat = dcd_reg->DEVCMDSTAT;
-
   uint32_t int_status = dcd_reg->INTSTAT;
-	int_status &= dcd_reg->INTEN;
+  int_status &= dcd_reg->INTEN;
   dcd_reg->INTSTAT = int_status; // Acknowledge handled interrupt
 
   if (int_status == 0) return;
 
+  // Snapshot after the INTSTAT ack: latch bits persist (RWC) so nothing is lost, while the reverse
+  // order could consume INTSTAT bit0 for a SETUP not yet visible in the snapshot - stranding the
+  // SETUP (INTSTAT is edge-latched) and feeding bit0 to process_xfer_isr as a bogus completion.
+  uint32_t const cmd_stat = dcd_reg->DEVCMDSTAT;
+
   //------------- Device Status -------------//
   if ( int_status & INT_DEVICE_STATUS_MASK )
   {
-    dcd_reg->DEVCMDSTAT |= DEVCMDSTAT_RESET_CHANGE_MASK | DEVCMDSTAT_CONNECT_CHANGE_MASK | DEVCMDSTAT_SUSPEND_CHANGE_MASK;
+    // clear only the change latches observed in the snapshot: one latched by hardware between the
+    // snapshot and this write would be acknowledged unseen (its DEV_INT re-latches and dispatches
+    // next pass instead)
+    devcmdstat_update(dcd_reg, 0, cmd_stat &
+                      (DEVCMDSTAT_RESET_CHANGE_MASK | DEVCMDSTAT_CONNECT_CHANGE_MASK | DEVCMDSTAT_SUSPEND_CHANGE_MASK));
 
     if ( cmd_stat & DEVCMDSTAT_RESET_CHANGE_MASK) // bus reset
     {
@@ -653,15 +689,43 @@ void dcd_int_handler(uint8_t rhport)
     _dcd.ep[0][0].cmd_sts.active = _dcd.ep[1][0].cmd_sts.active = 0;
     _dcd.ep[0][0].cmd_sts.stall = _dcd.ep[1][0].cmd_sts.stall = 0;
 
-    dcd_reg->DEVCMDSTAT |= DEVCMDSTAT_SETUP_RECEIVED_MASK;
+    // UM flow: ack the latch FIRST, then read the payload. This IP has no setup lockout, so a
+    // back-to-back SETUP can overwrite _dcd.setup_packet at any time - but with the latch already
+    // released, any such overwrite re-latches SETUP_RECEIVED and is redelivered (worst case a
+    // superseded duplicate, absorbed by usbd's queued-setup counter). The reverse order can
+    // consume the newer SETUP's latch unseen and lose it.
+    devcmdstat_update(dcd_reg, 0, DEVCMDSTAT_SETUP_RECEIVED_MASK);
+
+    // UM11126 Fig 163 (control EP0 flowchart) requires clearing the EP0IN interrupt here: a
+    // control IN completion latched before this SETUP must not reach usbd after it, where it
+    // would be applied to the new request and arm its status stage early. EP0OUT goes with it -
+    // bit0 is set by SETUP reception too, and left set it would replay next pass as a phantom
+    // completion. Neither can discard live work: the SETUP latch NAKs all EP0 traffic until the
+    // update above, and both EP0 Active bits were cleared a few lines up.
+    dcd_reg->INTSTAT = TU_BIT(0) | TU_BIT(1);
 
-    dcd_event_setup_received(rhport, _dcd.setup_packet, true);
+    // Copied a byte at a time rather than with memcpy: C orders volatile accesses only against
+    // each other, so a non-volatile copy of this buffer may be sunk below the guard read that
+    // follows - gcc does exactly that at -O2 and -O3, leaving only -Os correct.
+    uint8_t setup_copy[8];
+    for (uint8_t i = 0; i < sizeof(setup_copy); i++) {
+      setup_copy[i] = _dcd.setup_packet[i];
+    }
+
+    // a SETUP that raced in after the acks (its bit0 consumed above) makes this copy suspect:
+    // its latch is visible again, so re-raise the endpoint interrupt and let the next pass
+    // deliver the newer payload rather than passing up bytes that may be torn between the two
+    if (dcd_reg->DEVCMDSTAT & DEVCMDSTAT_SETUP_RECEIVED_MASK) {
+      dcd_reg->INTSETSTAT = TU_BIT(0);
+    } else {
+      dcd_event_setup_received(rhport, setup_copy, true);
+    }
 
     // keep waiting for next setup
     prepare_setup_packet(rhport);
 
-    // clear bit0
-    int_status = tu_bit_clear(int_status, 0);
+    // drop both EP0 bits: acked above, and neither belongs to the request this SETUP starts
+    int_status &= ~(TU_BIT(0) | TU_BIT(1));
   }
 
   // Endpoint transfer complete interrupt
diff --git a/src/portable/ohci/ohci.c b/src/portable/ohci/ohci.c
index e2c5956b3..2a174e46c 100644
--- a/src/portable/ohci/ohci.c
+++ b/src/portable/ohci/ohci.c
@@ -378,7 +378,7 @@ static void ed_list_remove_by_addr(ohci_ed_t * p_head, uint8_t dev_addr) {
   ohci_ed_t* p_prev = p_head;
 
   while (p_prev->next) {
-    ohci_ed_t* ed = (ohci_ed_t*)_virt_addr((void*)p_prev->next);
+    ohci_ed_t* ed = hcd_dcache_uncached((ohci_ed_t*)_virt_addr((void*)p_prev->next));
 
     if (ed->w0.dev_addr == dev_addr) {
       // Prevent Host Controller from processing this ED while we remove it
@@ -387,12 +387,28 @@ static void ed_list_remove_by_addr(ohci_ed_t * p_head, uint8_t dev_addr) {
       // unlink ed, will also move up p_prev
       p_prev->next = ed->next;
 
-      // point the removed ED's next pointer to list head to make sure HC can always safely move away from this ED
-      ed->next = (uint32_t)_phys_addr(p_head);
-      ed->w0.used = 0;
-      ed->w0.skip = 0;
+      // Control endpoints (EP number 0) are statically allocated with the device which are only reused
+      // after connection of another device long after HC has finished with them now, these can be freed immediately.
+      if (ed->w0.ep_number != 0) {
+        // Wait until the next frame before reclaiming the ED and its TDs. Set the deadline before
+        // publishing is_reclaiming so a pending SOF IRQ cannot use an older deadline for this ED.
+        ohci_data.reclaim_frame = (uint16_t)(OHCI_REG->frame_number + 1);
+        ed->w0.is_reclaiming = 1;
+
+        // 5.2.7.1.2 Removing. Disable list processing for bulk
+        if (p_head == p_ed_head[TUSB_XFER_BULK]) {
+          OHCI_REG->control &= ~OHCI_CONTROL_LIST_BULK_ENABLE_MASK;
+        }
+
+        // Temporarily enable SOF IRQ. Clear any pending SOF first to wait for the next frame.
+        OHCI_REG->interrupt_status = OHCI_INT_SOF_MASK;
+        OHCI_REG->interrupt_enable = OHCI_INT_SOF_MASK;
+      } else {
+        ed->w0.used = 0;
+        ed->w0.skip = 0;
+      }
     } else {
-      p_prev = (ohci_ed_t*)_virt_addr((void*)p_prev->next);
+      p_prev = ed;
     }
   }
 }
@@ -400,6 +416,7 @@ static void ed_list_remove_by_addr(ohci_ed_t * p_head, uint8_t dev_addr) {
 static ohci_gtd_t* gtd_find_free(void) {
   for (uint8_t i = 0; i < GTD_MAX; i++) {
     if (!ohci_data.gtd_pool[i].used) {
+      ohci_data.gtd_pool[i].used = 1;
       return &ohci_data.gtd_pool[i];
     }
   }
@@ -652,6 +669,60 @@ void hcd_int_handler(uint8_t hostid, bool in_isr) {
   // Disable MIE as per OHCI spec 5.3
   OHCI_REG->interrupt_disable = OHCI_INT_MASTER_ENABLE_MASK;
 
+  // Start of frame (SOF). Signed subtraction handles frame number rollover and delayed interrupts.
+  if ((int_status & OHCI_INT_SOF_MASK) &&
+      ((int16_t)((uint16_t)OHCI_REG->frame_number - ohci_data.reclaim_frame) >= 0)) {
+    OHCI_REG->interrupt_disable = OHCI_INT_SOF_MASK;
+
+    bool re_enable_lists = false;
+
+    for (size_t i = 0; i < ED_MAX; i++) {
+      ohci_ed_t* ed = hcd_dcache_uncached(&ohci_data.ed_pool[i]);
+      if (ed->w0.used && ed->w0.is_reclaiming) {
+        TU_ASSERT(ed->w0.skip == 1, );
+        TU_ASSERT(ed->w0.ep_number != 0, );
+
+        // Reclaim orphaned TDs
+        uint32_t td_addr = ed->td_head.address & ~0x0F;
+        while (td_addr) {
+          if (!ed->w0.is_iso) {
+            ohci_gtd_t *gtd = (ohci_gtd_t*)_virt_addr((void*)(uintptr_t)td_addr);
+            gtd->used = 0;
+          } else {
+            // TODO: Free ITD once implemented
+          }
+
+          if (td_addr == ed->td_tail) {
+            break;
+          }
+          td_addr = ((ohci_td_item_t*)_virt_addr((void*)(uintptr_t)td_addr))->next;
+        }
+
+        ed->w0.is_reclaiming = 0;
+        ed->w0.used = 0;
+        ed->w0.skip = 0;
+
+        re_enable_lists = true;
+      }
+    }
+
+    if (re_enable_lists) {
+      // 5.2.7.1.2 Removing
+      // Reset current ED pointers and re-enable lists
+      // Once the next frame has started, the HcControlCurrentED or HcBulkCurrentED register should be adjusted so
+      // that it does not point to the Endpoint Descriptor being removed (for simplicity you may just write
+      // a zero to the register);
+      if (!(OHCI_REG->control & OHCI_CONTROL_LIST_CONTROL_ENABLE_MASK)) {
+        OHCI_REG->control_current_ed = 0;
+        OHCI_REG->control |= OHCI_CONTROL_LIST_CONTROL_ENABLE_MASK;
+      }
+      if (!(OHCI_REG->control & OHCI_CONTROL_LIST_BULK_ENABLE_MASK)) {
+        OHCI_REG->bulk_current_ed = 0;
+        OHCI_REG->control |= OHCI_CONTROL_LIST_BULK_ENABLE_MASK;
+      }
+    }
+  }
+
   // Frame number overflow
   if (int_status & OHCI_INT_FRAME_OVERFLOW_MASK) {
     ohci_data.frame_number_hi++;
diff --git a/src/portable/ohci/ohci.h b/src/portable/ohci/ohci.h
index 84ae04b0f..e28c6404f 100644
--- a/src/portable/ohci/ohci.h
+++ b/src/portable/ohci/ohci.h
@@ -107,7 +107,8 @@ typedef union {
     // HCD: make use of 5 reserved bits
     uint32_t used              : 1;
     uint32_t is_interrupt_xfer : 1;
-    uint32_t                   : 3;
+    uint32_t is_reclaiming     : 1;
+    uint32_t                   : 2;
   };
   uint32_t value;
 } ohci_ed_word0_t;
@@ -182,6 +183,7 @@ typedef struct TU_ATTR_ALIGNED(256) {
   gtd_extra_data_t gtd_extra[GTD_MAX];
 
   volatile uint16_t frame_number_hi;
+  volatile uint16_t reclaim_frame;
 } ohci_data_t;
 
 //--------------------------------------------------------------------+
diff --git a/src/portable/synopsys/dwc2/dcd_dwc2.c b/src/portable/synopsys/dwc2/dcd_dwc2.c
index 86aa54510..b2f1a93a4 100644
--- a/src/portable/synopsys/dwc2/dcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/dcd_dwc2.c
@@ -1143,7 +1143,12 @@ static void handle_incomplete_iso_in(uint8_t rhport) {
       xfer_ctl_t *xfer = XFER_CTL_BASE(epnum, TUSB_DIR_IN);
       if (xfer->iso_retry > 0) {
         xfer->iso_retry--;
-        // Restart ISO transfe: re-write TSIZ and CTL
+        // Restart ISO transfer: re-write DMA address, TSIZ, and CTL
+        #if CFG_TUD_DWC2_DMA_ENABLE
+        if (dma_device_enabled(dwc2)) {
+          epin->diepdma = (uintptr_t) xfer->buffer;
+        }
+        #endif
         dwc2_ep_tsize_t deptsiz = {.value = 0};
         deptsiz.xfer_size       = xfer->total_len;
         deptsiz.packet_count    = tu_div_ceil(xfer->total_len, xfer->max_size);
diff --git a/src/portable/synopsys/dwc2/hcd_dwc2.c b/src/portable/synopsys/dwc2/hcd_dwc2.c
index 089b839ae..5a171f80e 100644
--- a/src/portable/synopsys/dwc2/hcd_dwc2.c
+++ b/src/portable/synopsys/dwc2/hcd_dwc2.c
@@ -26,6 +26,12 @@
   #endif
 
   #define DWC2_CHANNEL_COUNT_MAX 16u // absolute max channel count
+
+  // Conservative time budget for enabling a slave-mode periodic OUT channel and writing its first packet before the
+  // current (micro)frame ends. HFNUM.FrRem is measured in PHY clocks; 1024 clocks are 17.1 us at 60 MHz, 21.3 us at
+  // 48 MHz, or 34.1 us at 30 MHz. Defer to SOF when less time remains.
+  #define DWC2_PERIODIC_OUT_MIN_FRREM 1024u
+
 TU_VERIFY_STATIC(CFG_TUH_DWC2_ENDPOINT_MAX <= 255, "currently only use 8-bit for index");
 
 enum {
@@ -37,7 +43,9 @@ enum {
 };
 
 enum {
-  HCD_XFER_PERIOD_SPLIT_NYET_MAX = 3
+  HCD_XFER_PERIOD_SPLIT_NYET_MAX = 3,
+  HCD_FRAME_NUMBER_MASK = 0x3fff,
+  HCD_FRAME_COUNT = HCD_FRAME_NUMBER_MASK + 1
 };
 
 //--------------------------------------------------------------------
@@ -56,18 +64,22 @@ typedef struct {
   };
 
   struct TU_ATTR_PACKED {
-    uint32_t uframe_interval : 18; // micro-frame interval
+    uint32_t uframe_interval : 19; // micro-frame interval
     uint32_t speed           : 2;
     uint32_t next_pid        : 2; // PID for next transfer
     uint32_t next_do_ping    : 1; // Do PING for next transfer if possible (highspeed OUT)
     uint32_t closing         : 1; // endpoint is closing
-    // uint32_t : 8;
+    uint32_t aborting        : 1; // periodic DMA channel is waiting for its automatic halt
+    uint32_t periodic_phase  : 1; // periodic transfer phase is established
+    uint32_t xfer_pending    : 1; // periodic transfer waiting for its service interval
+    // uint32_t : 4;
   };
 
-  uint32_t uframe_countdown; // micro-frame count down to transfer for periodic, only need 18-bit
+  uint32_t uframe_countdown; // micro-frame count down to transfer for periodic, only need 19-bit
 
   uint8_t* buffer;
   uint16_t buflen;
+  uint16_t periodic_frame; // frame/microframe number of the last scheduled periodic transaction
 } hcd_endpoint_t;
 
 // Additional info for each channel when it is active
@@ -86,6 +98,7 @@ typedef struct {
                            // be composed of multiple channel_xfer_start() (retry with NAK/NYET)
   uint16_t fifo_bytes;     // bytes written/read from/to FIFO (may not be transferred on USB bus).
   uint8_t  retry_disabled; // 1: channel was disabled to throttle a split retry (NAK in / XactErr out); re-arm on its halt
+  volatile bool aborting;  // periodic DMA abort waiting for the channel's automatic halt
 } hcd_xfer_t;
 
 typedef struct {
@@ -187,7 +200,7 @@ TU_ATTR_ALWAYS_INLINE static inline bool channel_disable(const dwc2_regs_t* dwc2
     //   the worst case), the controller generates a channel halted and disables the channel automatically.
     // - For split enabled channels (both non-periodic and periodic), channel disable must not be programmed randomly.
     //   However, channel disable can be programmed for specific scenarios such as NAK and FrmOvrn.
-    if (is_period && (channel->hcsplt & HCSPLT_SPLITEN)) {
+    if (is_period) {
       return true;
     }
   } else {
@@ -200,13 +213,86 @@ TU_ATTR_ALWAYS_INLINE static inline bool channel_disable(const dwc2_regs_t* dwc2
   return true;
 }
 
-// attempt to send IN token to receive data
-TU_ATTR_ALWAYS_INLINE static inline bool channel_send_in_token(const dwc2_regs_t* dwc2, dwc2_channel_t* channel) {
+// Retire all active host channels on root-port disconnect without waiting for
+// Channel Halted interrupts.
+// stop new channel/FIFO interrupts, flush queued slave requests, request a
+// halt for enabled channels, then clear their interrupt and software state.
+static void channel_cleanup_on_disconnect(dwc2_regs_t *dwc2) {
+  const uint32_t xfer_ints = GINTSTS_NPTX_FIFO_EMPTY | GINTSTS_PTX_FIFO_EMPTY | GINTSTS_HCINT;
+  dwc2->gintmsk &= ~xfer_ints;
+  dwc2->gintsts  = xfer_ints;
+  dwc2->haintmsk = 0;
+
+  const uint8_t max_channel = dwc2_channel_count(dwc2);
+  #if CFG_TUH_DWC2_SLAVE_ENABLE
+  if (!dma_host_enabled(dwc2)) {
+    // With CHENA clear, CHDIS flushes a posted request without consuming
+    // request-queue space. Clear EPDIR as required for this flush operation.
+    for (uint8_t ch_id = 0; ch_id < max_channel; ch_id++) {
+      if (_hcd_data.xfer[ch_id].allocated) {
+        dwc2_channel_t *channel = &dwc2->channel[ch_id];
+        const uint32_t  hcchar  = channel->hcchar;
+        if (hcchar & HCCHAR_CHENA) {
+          channel->hcchar = (hcchar & ~(HCCHAR_CHENA | HCCHAR_EPDIR)) | HCCHAR_CHDIS;
+        }
+      }
+    }
+  }
+  #endif
+
+  for (uint8_t ch_id = 0; ch_id < max_channel; ch_id++) {
+    if (_hcd_data.xfer[ch_id].allocated) {
+      dwc2_channel_t *channel = &dwc2->channel[ch_id];
+      const uint32_t  hcchar  = channel->hcchar;
+      if (hcchar & HCCHAR_CHENA) {
+        channel->hcchar = hcchar | HCCHAR_CHDIS;
+      }
+      channel->hcintmsk = 0;
+      channel->hcint    = 0xFFFFFFFFU;
+    }
+  }
+
+  tu_memclr(_hcd_data.xfer, sizeof(_hcd_data.xfer));
+  for (uint8_t ep_id = 0; ep_id < CFG_TUH_DWC2_ENDPOINT_MAX; ep_id++) {
+    hcd_endpoint_t *edpt = &_hcd_data.edpt[ep_id];
+    if (edpt->hcchar_bm.enable) {
+      edpt->closing      = 1;
+      edpt->xfer_pending = 0;
+    }
+  }
+}
+
+// Enable a channel, selecting the following frame for a new periodic transfer.
+// Return that frame from the same HFNUM sample used for ODDFRM selection.
+// Clear CHDIS explicitly: a halted channel may retain it in HCCHAR.
+TU_ATTR_ALWAYS_INLINE static inline uint16_t channel_enable(dwc2_regs_t* dwc2, dwc2_channel_t* channel,
+                                                            bool next_periodic_frame) {
+  uint32_t hcchar = channel->hcchar & ~HCCHAR_CHDIS;
+  uint16_t periodic_frame = 0;
+  if (next_periodic_frame) {
+    // Prevent the USB interrupt from consuming the selected frame before
+    // HCCHAR.CHENA is written. Queue-space waits happen before this helper.
+    const uint32_t gahbcfg = dwc2->gahbcfg;
+    dwc2->gahbcfg          = gahbcfg & ~GAHBCFG_GINT;
+    const uint32_t hfnum   = dwc2->hfnum;
+    hcchar                 = (hcchar & ~HCCHAR_ODDFRM) | (((hfnum & 1u) ^ 1u) << HCCHAR_ODDFRM_Pos);
+    channel->hcchar        = hcchar | HCCHAR_CHENA;
+    periodic_frame         = (uint16_t) ((hfnum + 1u) & HCD_FRAME_NUMBER_MASK);
+    dwc2->gahbcfg          = gahbcfg;
+  } else {
+    channel->hcchar = hcchar | HCCHAR_CHENA;
+  }
+  return periodic_frame;
+}
+
+// Attempt to send an IN token to receive data. For a new periodic transfer,
+// select its frame only after request-queue space is available.
+TU_ATTR_ALWAYS_INLINE static inline uint16_t channel_send_in_token(dwc2_regs_t* dwc2, dwc2_channel_t* channel,
+                                                                   bool next_periodic_frame) {
   while (0 == req_queue_avail(dwc2, channel_is_periodic(channel->hcchar))) {
     // blocking wait for request queue available
   }
-  channel->hcchar |= HCCHAR_CHENA;
-  return true;
+  return channel_enable(dwc2, channel, next_periodic_frame);
 }
 
 // Find currently enabled channel. Note: EP0 is bidirectional
@@ -262,11 +348,13 @@ static void edpt_close(dwc2_regs_t *dwc2, uint8_t ep_id) {
 
 // Find an endpoint that is opened previously with hcd_edpt_open()
 // Note: EP0 is bidirectional
-TU_ATTR_ALWAYS_INLINE static inline uint8_t edpt_find_opened(uint8_t dev_addr, uint8_t ep_num, uint8_t ep_dir) {
+TU_ATTR_ALWAYS_INLINE static inline uint8_t edpt_find_opened(uint8_t dev_addr, uint8_t ep_num, uint8_t ep_dir,
+                                                              bool include_closing) {
   for (uint8_t i = 0; i < (uint8_t)CFG_TUH_DWC2_ENDPOINT_MAX; i++) {
     const hcd_endpoint_t     *edpt      = &_hcd_data.edpt[i];
     const dwc2_channel_char_t hcchar_bm = edpt->hcchar_bm;
-    if (hcchar_bm.enable && hcchar_bm.dev_addr == dev_addr && hcchar_bm.ep_num == ep_num &&
+    if (hcchar_bm.enable && (include_closing || !edpt->closing) && hcchar_bm.dev_addr == dev_addr &&
+        hcchar_bm.ep_num == ep_num &&
         (ep_num == 0 || hcchar_bm.ep_dir == ep_dir)) {
       return i;
     }
@@ -336,13 +424,13 @@ TU_ATTR_ALWAYS_INLINE static inline uint8_t cal_next_pid(uint8_t pid, uint8_t pa
 static void dfifo_host_init(uint8_t rhport, bool is_hs_phy) {
   const dwc2_controller_t* dwc2_controller = &_dwc2_controller[rhport];
   dwc2_regs_t* dwc2 = DWC2_REG(rhport);
-  const dwc2_ghwcfg2_t ghwcfg2 = {.value = dwc2->ghwcfg2};
+  const uint8_t channel_count = dwc2_channel_count(dwc2);
 
   // Scatter/Gather DMA mode is not yet supported. Buffer DMA only need 1 words per channel
   const bool is_dma = dma_host_enabled(dwc2);
   uint16_t dfifo_top = dwc2_controller->otg_dfifo_depth;
   if (is_dma) {
-    dfifo_top -= ghwcfg2.num_host_ch;
+    dfifo_top -= channel_count;
   }
 
   // fixed allocation for now, improve later:
@@ -358,13 +446,12 @@ static void dfifo_host_init(uint8_t rhport, bool is_hs_phy) {
   }
 
   uint16_t nptxfsiz = 2 * nptx_largest;
-  uint16_t rxfsiz = 2 * (ptx_largest + 2) + ghwcfg2.num_host_ch;
+  uint16_t rxfsiz = 2 * (ptx_largest + 2) + channel_count;
   TU_ASSERT(dfifo_top >= (nptxfsiz + rxfsiz),);
   uint16_t ptxfsiz = dfifo_top - (nptxfsiz + rxfsiz);
 
   dwc2->gdfifocfg = (dfifo_top << GDFIFOCFG_EPINFOBASE_SHIFT) | dfifo_top;
 
-  dfifo_top -= rxfsiz;
   dwc2->grxfsiz = rxfsiz;
 
   dfifo_top -= nptxfsiz;
@@ -548,7 +635,7 @@ bool hcd_edpt_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_endpoint_t*
   edpt->next_pid = HCTSIZ_PID_DATA0;
   switch (desc_ep->bmAttributes.xfer) {
     case TUSB_XFER_ISOCHRONOUS:
-      edpt->uframe_interval = 1 << (desc_ep->bInterval - 1);
+      edpt->uframe_interval = 1u << (desc_ep->bInterval - 1);
       if (bus_info.speed == TUSB_SPEED_FULL) {
         edpt->uframe_interval <<= 3;
       }
@@ -556,7 +643,7 @@ bool hcd_edpt_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_endpoint_t*
 
     case TUSB_XFER_INTERRUPT:
       if (bus_info.speed == TUSB_SPEED_HIGH) {
-        edpt->uframe_interval = 1 << (desc_ep->bInterval - 1);
+        edpt->uframe_interval = 1u << (desc_ep->bInterval - 1);
       } else {
         edpt->uframe_interval = desc_ep->bInterval << 3;
       }
@@ -566,6 +653,13 @@ bool hcd_edpt_open(uint8_t rhport, uint8_t dev_addr, const tusb_desc_endpoint_t*
       break;
   }
 
+  if (channel_is_periodic(edpt->hcchar)) {
+    // HFNUM cannot distinguish elapsed periods longer than one counter cycle. USB permits the host to provide a
+    // shorter period, so bound the selected period to the history available from HFNUM.
+    const uint32_t ucount = (rh_speed == TUSB_SPEED_HIGH) ? 1u : 8u;
+    edpt->uframe_interval = tu_min32(edpt->uframe_interval, HCD_FRAME_COUNT * ucount);
+  }
+
   return true;
 }
 
@@ -573,7 +667,7 @@ bool hcd_edpt_close(uint8_t rhport, uint8_t daddr, uint8_t ep_addr) {
   dwc2_regs_t  *dwc2   = DWC2_REG(rhport);
   const uint8_t ep_num = tu_edpt_number(ep_addr);
   const uint8_t ep_dir = tu_edpt_dir(ep_addr);
-  const uint8_t ep_id  = edpt_find_opened(daddr, ep_num, ep_dir);
+  const uint8_t ep_id  = edpt_find_opened(daddr, ep_num, ep_dir, true);
   TU_ASSERT(ep_id < CFG_TUH_DWC2_ENDPOINT_MAX);
 
   edpt_close(dwc2, ep_id);
@@ -588,7 +682,10 @@ static void channel_xfer_out_wrapup(dwc2_regs_t* dwc2, uint8_t ch_id) {
   hcd_endpoint_t* edpt = &_hcd_data.edpt[xfer->ep_id];
 
   const dwc2_channel_tsize_t hctsiz = {.value = channel->hctsiz};
-  edpt->next_pid = hctsiz.pid; // save PID
+  const dwc2_channel_char_t hcchar = {.value = channel->hcchar};
+  if (hcchar.ep_type != HCCHAR_EPTYPE_ISOCHRONOUS) {
+    edpt->next_pid = hctsiz.pid; // save PID
+  }
 
   /* Since hctsiz.xfersize field reflects the number of bytes transferred via the AHB, not the USB)
    * For IN: we can use hctsiz.xfersize as remaining bytes.
@@ -597,7 +694,6 @@ static void channel_xfer_out_wrapup(dwc2_regs_t* dwc2, uint8_t ch_id) {
    * transfer was halted before its normal completion.
    */
   const uint16_t remain_packets = hctsiz.packet_count;
-  const dwc2_channel_char_t hcchar = {.value = channel->hcchar};
   const uint16_t total_packets = cal_packet_count(edpt->buflen, hcchar.ep_size);
   const uint16_t actual_bytes = (total_packets - remain_packets) * hcchar.ep_size;
 
@@ -607,20 +703,26 @@ static void channel_xfer_out_wrapup(dwc2_regs_t* dwc2, uint8_t ch_id) {
   edpt->buflen -= actual_bytes;
 }
 
-static bool channel_xfer_start(dwc2_regs_t* dwc2, uint8_t ch_id) {
+#if CFG_TUH_DWC2_SLAVE_ENABLE
+static bool channel_txfifo_write(dwc2_regs_t* dwc2, uint8_t ch_id, bool is_periodic);
+#endif
+static void periodic_xfer_defer(dwc2_regs_t* dwc2, hcd_endpoint_t* edpt, uint32_t uframe_countdown);
+
+static bool channel_xfer_start(dwc2_regs_t* dwc2, uint8_t ch_id, bool defer_periodic_out) {
   hcd_xfer_t* xfer = &_hcd_data.xfer[ch_id];
   hcd_endpoint_t* edpt = &_hcd_data.edpt[xfer->ep_id];
   dwc2_channel_char_t* hcchar_bm = &edpt->hcchar_bm;
   dwc2_channel_t* channel = &dwc2->channel[ch_id];
   bool const is_period = channel_is_periodic(edpt->hcchar);
-
+#if CFG_TUH_DWC2_SLAVE_ENABLE
+  const uint8_t saved_pid = edpt->next_pid;
+  const uint8_t saved_do_ping = edpt->next_do_ping;
+#endif
+  uint16_t periodic_frame = 0;
   // clear previous state
   xfer->fifo_bytes = 0;
 
   // hchar: restore but don't enable yet
-  if (is_period) {
-    hcchar_bm->odd_frame = 1 - (dwc2->hfnum & 1);   // transfer on next frame
-  }
   channel->hcchar = (edpt->hcchar & ~HCCHAR_CHENA);
 
   // hctsiz: zero length packet still count as 1
@@ -636,15 +738,17 @@ static bool channel_xfer_start(dwc2_regs_t* dwc2, uint8_t ch_id) {
   channel->hctsiz = hctsiz.value;
   edpt->next_do_ping = 0;
 
-  // pre-calculate next PID based on packet count, adjusted in transfer complete interrupt if short packet
+  // Single-transaction isochronous endpoints always use DATA0. Pre-calculate the next PID for other endpoints,
+  // adjusted in the transfer-complete interrupt if a short packet is received.
   if (hcchar_bm->ep_num == 0) {
     edpt->next_pid = HCTSIZ_PID_DATA1; // control data and status stage always start with DATA1
-  } else {
+  } else if (hcchar_bm->ep_type != HCCHAR_EPTYPE_ISOCHRONOUS) {
     edpt->next_pid = cal_next_pid(edpt->next_pid, packet_count);
   }
 
   channel->hcsplt = edpt->hcsplt;
   channel->hcint = 0xFFFFFFFFU; // clear all channel interrupts
+  dwc2->gintmsk |= GINTSTS_HCINT;
 
   if (dma_host_enabled(dwc2)) {
     channel->hcintmsk = HCINT_HALTED;
@@ -653,13 +757,19 @@ static bool channel_xfer_start(dwc2_regs_t* dwc2, uint8_t ch_id) {
     channel->hcdma = (uint32_t) edpt->buffer;
 
     if (hcchar_bm->ep_dir == TUSB_DIR_IN) {
-      channel_send_in_token(dwc2, channel);
+      periodic_frame = channel_send_in_token(dwc2, channel, is_period);
     } else {
       hcd_dcache_clean(edpt->buffer, edpt->buflen);
-      channel->hcchar |= HCCHAR_CHENA;
+      periodic_frame = channel_enable(dwc2, channel, is_period);
+    }
+  }
+#if CFG_TUH_DWC2_SLAVE_ENABLE
+  else {
+    uint32_t hcintmsk = HCINT_NAK | HCINT_XACT_ERR | HCINT_STALL |
+                        HCINT_XFER_COMPLETE | HCINT_DATATOGGLE_ERR;
+    if (is_period) {
+      hcintmsk |= HCINT_FARME_OVERRUN;
     }
-  } else {
-    uint32_t hcintmsk = HCINT_NAK | HCINT_XACT_ERR | HCINT_STALL | HCINT_XFER_COMPLETE | HCINT_DATATOGGLE_ERR;
     if (hcchar_bm->ep_dir == TUSB_DIR_IN) {
       hcintmsk |= HCINT_BABBLE_ERR | HCINT_DATATOGGLE_ERR | HCINT_ACK;
     } else {
@@ -677,16 +787,36 @@ static bool channel_xfer_start(dwc2_regs_t* dwc2, uint8_t ch_id) {
     // IN Token. If we got NAK, we have to re-enable the channel again in the interrupt. Due to the way usbh stack only
     // call hcd_edpt_xfer() once, we will need to manage de-allocate/re-allocate IN channel dynamically.
     if (hcchar_bm->ep_dir == TUSB_DIR_IN) {
-      channel_send_in_token(dwc2, channel);
+      periodic_frame = channel_send_in_token(dwc2, channel, is_period);
     } else {
-      channel->hcchar |= HCCHAR_CHENA;
-      if (edpt->buflen > 0) {
-        // To prevent conflict with other channel, we will enable periodic/non-periodic FIFO empty interrupt accordingly
-        // And write packet in the interrupt handler
+      // The final FIFO word creates the OUT request. Keep CHENA and that write
+      // atomic with respect to this controller's ISR.
+      // This region never waits for FIFO or queue space.
+      const uint32_t gahbcfg = dwc2->gahbcfg;
+      dwc2->gahbcfg = gahbcfg & ~GAHBCFG_GINT;
+      if (defer_periodic_out && is_period) {
+        const dwc2_hfnum_t hfnum = {.value = dwc2->hfnum};
+        if (hfnum.remainning < DWC2_PERIODIC_OUT_MIN_FRREM) {
+          edpt->next_pid = saved_pid;
+          edpt->next_do_ping = saved_do_ping;
+          dwc2->gahbcfg = gahbcfg;
+          return false;
+        }
+      }
+      periodic_frame = channel_enable(dwc2, channel, is_period);
+      if (edpt->buflen > 0 && channel_txfifo_write(dwc2, ch_id, is_period)) {
+        // The FIFO-empty interrupt handles only work that did not fit in the
+        // initial synchronous write.
         dwc2->gintmsk |= (is_period ? GINTSTS_PTX_FIFO_EMPTY : GINTSTS_NPTX_FIFO_EMPTY);
       }
+      dwc2->gahbcfg = gahbcfg;
     }
   }
+#endif
+
+  if (is_period && defer_periodic_out) {
+    edpt->periodic_frame = periodic_frame;
+  }
 
   return true;
 }
@@ -698,8 +828,48 @@ static bool edpt_xfer_kickoff(dwc2_regs_t* dwc2, uint8_t ep_id) {
   hcd_xfer_t* xfer = &_hcd_data.xfer[ch_id];
   xfer->ep_id = ep_id;
   xfer->result = XFER_RESULT_INVALID;
+  hcd_endpoint_t* edpt = &_hcd_data.edpt[ep_id];
+  const bool result = channel_xfer_start(dwc2, ch_id, true);
+  if (!result) {
+    channel_dealloc(dwc2, ch_id);
+    periodic_xfer_defer(dwc2, edpt, 0);
+    return true;
+  }
+  if (channel_is_periodic(_hcd_data.edpt[ep_id].hcchar)) {
+    edpt->periodic_phase = 1;
+    edpt->xfer_pending = 0;
+  }
+  return result;
+}
+
+static uint32_t periodic_xfer_countdown(dwc2_regs_t* dwc2, hcd_endpoint_t const* edpt) {
+  const uint32_t ucount = (hprt_speed_get(dwc2) == TUSB_SPEED_HIGH) ? 1u : 8u;
+  const uint16_t frame = (uint16_t) (dwc2->hfnum & HCD_FRAME_NUMBER_MASK);
+  const uint16_t elapsed_frames = (uint16_t) (frame - edpt->periodic_frame) & HCD_FRAME_NUMBER_MASK;
+  const uint32_t elapsed_uframes = (uint32_t) elapsed_frames * ucount;
+
+  if (elapsed_uframes < edpt->uframe_interval) {
+    return edpt->uframe_interval - elapsed_uframes - ucount;
+  }
+
+  // The service opportunity was missed. Keep the established phase and use
+  // the next interval rather than starting a new interval from this request.
+  return edpt->uframe_interval - (elapsed_uframes % edpt->uframe_interval) - ucount;
+}
+
+static void periodic_xfer_defer(dwc2_regs_t* dwc2, hcd_endpoint_t* edpt, uint32_t uframe_countdown) {
+  const uint32_t gahbcfg = dwc2->gahbcfg;
+  dwc2->gahbcfg = gahbcfg & ~GAHBCFG_GINT;
 
-  return channel_xfer_start(dwc2, ch_id);
+  edpt->uframe_countdown = uframe_countdown;
+  edpt->xfer_pending = 1;
+
+  if (0 == (dwc2->gintmsk & GINTMSK_SOFM)) {
+    dwc2->gintsts = GINTSTS_SOF;
+    dwc2->gintmsk |= GINTMSK_SOFM;
+  }
+
+  dwc2->gahbcfg = gahbcfg;
 }
 
 bool hcd_edpt_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr, uint8_t * buffer, uint16_t buflen) {
@@ -707,10 +877,10 @@ bool hcd_edpt_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr, uint8_t *
   const uint8_t ep_num = tu_edpt_number(ep_addr);
   const uint8_t ep_dir = tu_edpt_dir(ep_addr);
 
-  uint8_t ep_id = edpt_find_opened(dev_addr, ep_num, ep_dir);
-  TU_ASSERT(ep_id < CFG_TUH_DWC2_ENDPOINT_MAX);
+  uint8_t ep_id = edpt_find_opened(dev_addr, ep_num, ep_dir, false);
+  TU_VERIFY(ep_id < CFG_TUH_DWC2_ENDPOINT_MAX);
   hcd_endpoint_t *edpt = &_hcd_data.edpt[ep_id];
-  TU_VERIFY(edpt->closing == 0); // skip if endpoint is closing
+  TU_VERIFY(edpt->closing == 0 && edpt->aborting == 0); // skip if endpoint is closing or aborting
 
   edpt->buffer = buffer;
   edpt->buflen = buflen;
@@ -720,6 +890,26 @@ bool hcd_edpt_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr, uint8_t *
     edpt->hcchar_bm.ep_dir = ep_dir;
   }
 
+  if (channel_is_periodic(edpt->hcchar)) {
+    const uint32_t ucount = (hprt_speed_get(dwc2) == TUSB_SPEED_HIGH) ? 1u : 8u;
+#if CFG_TUH_DWC2_SLAVE_ENABLE
+    // Establish a slower slave-mode OUT schedule from SOF. bInterval=1 must be queued immediately to avoid
+    // losing every other service opportunity.
+    if (!dma_host_enabled(dwc2) && ep_dir == TUSB_DIR_OUT && !edpt->periodic_phase &&
+        edpt->uframe_interval > ucount) {
+      periodic_xfer_defer(dwc2, edpt, 0);
+      return true;
+    }
+#endif
+    if (edpt->periodic_phase && edpt->uframe_interval > ucount) {
+      const uint32_t countdown = periodic_xfer_countdown(dwc2, edpt);
+      if (countdown > 0) {
+        periodic_xfer_defer(dwc2, edpt, countdown);
+        return true;
+      }
+    }
+  }
+
   return edpt_xfer_kickoff(dwc2, ep_id);
 }
 
@@ -729,11 +919,39 @@ bool hcd_edpt_abort_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr) {
   dwc2_regs_t* dwc2 = DWC2_REG(rhport);
   const uint8_t ep_num = tu_edpt_number(ep_addr);
   const uint8_t ep_dir = tu_edpt_dir(ep_addr);
-  const uint8_t ep_id = edpt_find_opened(dev_addr, ep_num, ep_dir);
+  const uint8_t ep_id = edpt_find_opened(dev_addr, ep_num, ep_dir, false);
   TU_VERIFY(ep_id < CFG_TUH_DWC2_ENDPOINT_MAX);
+  hcd_endpoint_t* edpt = &_hcd_data.edpt[ep_id];
+
+  hcd_int_disable(rhport);
+
+  const bool xfer_pending = edpt->xfer_pending;
+  if (xfer_pending) {
+    edpt->xfer_pending = 0;
+    edpt->uframe_countdown = 0;
+  }
+
+  if (xfer_pending) {
+    hcd_int_enable(rhport);
+    return true;
+  }
+
+  // A periodic DMA channel must halt naturally at the next service boundary. Prevent a replacement transfer until the
+  // halt ISR retires the channel, and suppress completion for the aborted transfer.
+  if (dma_host_enabled(dwc2) && channel_is_periodic(edpt->hcchar)) {
+    const uint8_t ch_id = channel_find_enabled(dwc2, dev_addr, ep_num, ep_dir);
+    if (ch_id < 16) {
+      hcd_xfer_t* xfer = &_hcd_data.xfer[ch_id];
+      edpt->aborting = 1;
+      xfer->aborting = true;
+      hcd_int_enable(rhport);
+      return true;
+    }
+  }
 
-  // hcd_int_disable(rhport);
+  hcd_int_enable(rhport);
 
+  // Channel disable may wait for request-queue space in slave mode.
   // Find enabled channeled and disable it, channel will be de-allocated in the interrupt handler
   const uint8_t ch_id = channel_find_enabled(dwc2, dev_addr, ep_num, ep_dir);
   if (ch_id < 16) {
@@ -741,15 +959,13 @@ bool hcd_edpt_abort_xfer(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr) {
     channel_disable(dwc2, channel);
   }
 
-  // hcd_int_enable(rhport);
-
   return true;
 }
 
 // Submit a special transfer to send 8-byte Setup Packet, when complete hcd_event_xfer_complete() must be invoked
 bool hcd_setup_send(uint8_t rhport, uint8_t dev_addr, const uint8_t setup_packet[8]) {
-  uint8_t ep_id = edpt_find_opened(dev_addr, 0, TUSB_DIR_OUT);
-  TU_ASSERT(ep_id < CFG_TUH_DWC2_ENDPOINT_MAX); // no opened endpoint
+  uint8_t ep_id = edpt_find_opened(dev_addr, 0, TUSB_DIR_OUT, false);
+  TU_VERIFY(ep_id < CFG_TUH_DWC2_ENDPOINT_MAX); // endpoint can close asynchronously on disconnect
   hcd_endpoint_t* edpt = &_hcd_data.edpt[ep_id];
   edpt->next_pid = HCTSIZ_PID_SETUP;
 
@@ -761,7 +977,7 @@ bool hcd_edpt_clear_stall(uint8_t rhport, uint8_t dev_addr, uint8_t ep_addr) {
   (void) rhport;
   const uint8_t ep_num = tu_edpt_number(ep_addr);
   const uint8_t ep_dir = tu_edpt_dir(ep_addr);
-  const uint8_t ep_id = edpt_find_opened(dev_addr, ep_num, ep_dir);
+  const uint8_t ep_id = edpt_find_opened(dev_addr, ep_num, ep_dir, false);
   TU_VERIFY(ep_id < CFG_TUH_DWC2_ENDPOINT_MAX);
   hcd_endpoint_t* edpt = &_hcd_data.edpt[ep_id];
 
@@ -790,7 +1006,7 @@ static void channel_xfer_in_retry(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hci
       if (xfer->period_split_nyet_count < HCD_XFER_PERIOD_SPLIT_NYET_MAX) {
         hcchar.odd_frame = 1 - (dwc2->hfnum & 1); // transfer on next frame
         channel->hcchar = hcchar.value;
-        channel_send_in_token(dwc2, channel);
+        channel_send_in_token(dwc2, channel, false);
         return;
       } else {
         // too many NYET, de-allocate channel with below code
@@ -803,23 +1019,20 @@ static void channel_xfer_in_retry(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hci
       // retry on next frame if bInterval is 1
       hcchar.odd_frame = 1 - (dwc2->hfnum & 1);
       channel->hcchar = hcchar.value;
-      channel_send_in_token(dwc2, channel);
+      channel_send_in_token(dwc2, channel, false);
     } else {
       // otherwise, de-allocate channel, enable SOF set frame counter for later transfer
       const dwc2_channel_tsize_t hctsiz = {.value = channel->hctsiz};
-      edpt->next_pid = hctsiz.pid; // save PID
-      edpt->uframe_countdown = edpt->uframe_interval - ucount;
-      // enable SOF interrupt if not already enabled
-      if (0 == (dwc2->gintmsk & GINTMSK_SOFM)) {
-        dwc2->gintsts = GINTSTS_SOF;
-        dwc2->gintmsk |= GINTMSK_SOFM;
+      if (hcchar.ep_type != HCCHAR_EPTYPE_ISOCHRONOUS) {
+        edpt->next_pid = hctsiz.pid; // save PID
       }
+      periodic_xfer_defer(dwc2, edpt, periodic_xfer_countdown(dwc2, edpt));
       // already halted, de-allocate channel (called from DMA isr)
       channel_dealloc(dwc2, ch_id);
     }
   } else {
     // for control/bulk: retry immediately
-    channel_send_in_token(dwc2, channel);
+    channel_send_in_token(dwc2, channel, false);
   }
 }
 
@@ -854,6 +1067,13 @@ static void handle_rxflvl_irq(uint8_t rhport) {
       // In packet received, pop this entry --> ACK interrupt
       const uint16_t byte_count = grxstsp.byte_count;
       hcd_xfer_t* xfer = &_hcd_data.xfer[ch_id];
+      if (!xfer->allocated) {
+        // Discard data for a channel retired by disconnect.
+        for (uint16_t count = 0; count < byte_count; count += sizeof(uint32_t)) {
+          (void) dwc2->fifo[0][0];
+        }
+        break;
+      }
       TU_ASSERT(xfer->ep_id < CFG_TUH_DWC2_ENDPOINT_MAX,);
       hcd_endpoint_t* edpt = &_hcd_data.edpt[xfer->ep_id];
 
@@ -883,38 +1103,50 @@ static void handle_rxflvl_irq(uint8_t rhport) {
   }
 }
 
-// return true if there is still pending data and need more ISR
+// Return true if data remains for a later FIFO-empty interrupt.
+static bool channel_txfifo_write(dwc2_regs_t* dwc2, uint8_t ch_id, bool is_periodic) {
+  hcd_xfer_t* xfer = &_hcd_data.xfer[ch_id];
+  dwc2_channel_t* channel = &dwc2->channel[ch_id];
+  const dwc2_channel_char_t hcchar = {.value = channel->hcchar};
+  TU_ASSERT(xfer->ep_id < CFG_TUH_DWC2_ENDPOINT_MAX);
+  hcd_endpoint_t* edpt = &_hcd_data.edpt[xfer->ep_id];
+  const dwc2_channel_tsize_t hctsiz = {.value = channel->hctsiz};
+  const uint16_t remain_packets = hctsiz.packet_count;
+
+  for (uint16_t i = 0; i < remain_packets; i++) {
+    const uint16_t remain_bytes = edpt->buflen - xfer->fifo_bytes;
+    const uint16_t xact_bytes = tu_min16(remain_bytes, hcchar.ep_size);
+
+    // The packet's last FIFO word creates its request-queue entry.
+    // HNPTXSTS differs by one request-queue bit, which is outside these fields.
+    const dwc2_hptxsts_t txsts = {.value = (is_periodic ? dwc2->hptxsts : dwc2->hnptxsts)};
+    if ((xact_bytes > (txsts.fifo_available << 2)) || (txsts.req_queue_available == 0)) {
+      return true;
+    }
+
+    tu_hwfifo_write(dwc2->fifo[ch_id], edpt->buffer + xfer->fifo_bytes, xact_bytes, NULL);
+    xfer->fifo_bytes += xact_bytes;
+  }
+
+  return false;
+}
+
+// Return true if at least one matching channel needs another interrupt.
 static bool handle_txfifo_empty(dwc2_regs_t* dwc2, bool is_periodic) {
   const uint8_t max_channel = dwc2_channel_count(dwc2);
   for (uint8_t ch_id = 0; ch_id < max_channel; ch_id++) {
+    hcd_xfer_t* xfer = &_hcd_data.xfer[ch_id];
     dwc2_channel_t* channel = &dwc2->channel[ch_id];
     const dwc2_channel_char_t hcchar = {.value = channel->hcchar};
-    // skip writing to FIFO if channel is expecting halted.
-    if (0 == (channel->hcintmsk & HCINT_HALTED) && (hcchar.ep_dir == TUSB_DIR_OUT)) {
-      hcd_xfer_t *xfer = &_hcd_data.xfer[ch_id];
-      TU_ASSERT(xfer->ep_id < CFG_TUH_DWC2_ENDPOINT_MAX);
-      hcd_endpoint_t* edpt = &_hcd_data.edpt[xfer->ep_id];
-      const dwc2_channel_tsize_t hctsiz = {.value = channel->hctsiz};
-      const uint16_t remain_packets = hctsiz.packet_count;
-      for (uint16_t i = 0; i < remain_packets; i++) {
-        const uint16_t remain_bytes = edpt->buflen - xfer->fifo_bytes;
-        const uint16_t xact_bytes = tu_min16(remain_bytes, hcchar.ep_size);
-
-        // skip if there is not enough space in FIFO and RequestQueue.
-        // Packet's last word written to FIFO will trigger a request queue
-        // Use period txsts for both p/np to get request queue space available (1-bit difference, it is small enough)
-        const dwc2_hptxsts_t txsts = {.value = (is_periodic ? dwc2->hptxsts : dwc2->hnptxsts)};
-        if ((xact_bytes > (txsts.fifo_available << 2)) || (txsts.req_queue_available == 0)) {
-          return true;
-        }
-
-        tu_hwfifo_write(dwc2->fifo[ch_id], edpt->buffer + xfer->fifo_bytes, xact_bytes, NULL);
-        xfer->fifo_bytes += xact_bytes;
+    if (xfer->allocated && channel_is_periodic(hcchar.value) == is_periodic &&
+        0 == (channel->hcintmsk & HCINT_HALTED) && hcchar.ep_dir == TUSB_DIR_OUT) {
+      if (channel_txfifo_write(dwc2, ch_id, is_periodic)) {
+        return true;
       }
     }
   }
 
-  return false; // no channel has pending data
+  return false;
 }
 
 static bool handle_channel_in_slave(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hcint) {
@@ -932,7 +1164,8 @@ static bool handle_channel_in_slave(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t h
   // }
 
   if (hcint & HCINT_XFER_COMPLETE) {
-    if (edpt->hcchar_bm.ep_num != 0) {
+    if (edpt->hcchar_bm.ep_num != 0 &&
+        edpt->hcchar_bm.ep_type != HCCHAR_EPTYPE_ISOCHRONOUS) {
       edpt->next_pid = hctsiz.pid; // save pid (already toggled)
     }
 
@@ -945,6 +1178,17 @@ static bool handle_channel_in_slave(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t h
       xfer->result = XFER_RESULT_SUCCESS;
     }
 
+    if (channel_is_periodic(channel->hcchar) && remain_packets == 0) {
+      // The core has already halted a completed periodic IN channel. Complete
+      // it now so the next interval can be submitted without another halt IRQ.
+      is_done = true;
+    } else {
+      channel_disable(dwc2, channel);
+    }
+  } else if (hcint & HCINT_FARME_OVERRUN) {
+    if (edpt->hcchar_bm.ep_type == HCCHAR_EPTYPE_ISOCHRONOUS) {
+      xfer->result = XFER_RESULT_FAILED;
+    }
     channel_disable(dwc2, channel);
   } else if (hcint & (HCINT_XACT_ERR | HCINT_BABBLE_ERR | HCINT_STALL)) {
     if (hcint & HCINT_STALL) {
@@ -982,7 +1226,7 @@ static bool handle_channel_in_slave(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t h
         channel->hcintmsk |= HCINT_NYET;
         hcsplt.split_compl = 1;
         channel->hcsplt = hcsplt.value;
-        channel_send_in_token(dwc2, channel);
+        channel_send_in_token(dwc2, channel, false);
       } else {
         // do nothing for complete split with DATA, this will trigger XferComplete and handled there
       }
@@ -993,7 +1237,7 @@ static bool handle_channel_in_slave(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t h
         // still more packet to receive, also reset to start split
         hcsplt.split_compl = 0;
         channel->hcsplt = hcsplt.value;
-        channel_send_in_token(dwc2, channel);
+        channel_send_in_token(dwc2, channel, false);
       }
     }
   } else if (hcint & HCINT_HALTED) {
@@ -1039,6 +1283,12 @@ static bool handle_channel_out_slave(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t
   } else if (hcint & HCINT_STALL) {
     xfer->result = XFER_RESULT_STALLED;
     channel_disable(dwc2, channel);
+  } else if (hcint & HCINT_FARME_OVERRUN) {
+    channel_xfer_out_wrapup(dwc2, ch_id);
+    if (edpt->hcchar_bm.ep_type == HCCHAR_EPTYPE_ISOCHRONOUS) {
+      xfer->result = XFER_RESULT_FAILED;
+    }
+    channel_disable(dwc2, channel);
   } else if (hcint & HCINT_NYET) {
     xfer->err_count = 0;
     if (hcsplt.split_en == 1u) {
@@ -1074,7 +1324,7 @@ static bool handle_channel_out_slave(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t
       is_done = true;
     } else {
       // Got here due to NAK or NYET
-      TU_ASSERT(channel_xfer_start(dwc2, ch_id));
+      TU_ASSERT(channel_xfer_start(dwc2, ch_id, false));
     }
   } else if (hcint & HCINT_ACK) {
     xfer->err_count = 0;
@@ -1126,9 +1376,13 @@ static bool handle_channel_in_dma(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hci
       if (xfer->closing) {
         is_done = true;
       } else {
-        channel_send_in_token(dwc2, channel);
+        channel_send_in_token(dwc2, channel, false);
       }
     } else if (hcint & (HCINT_XFER_COMPLETE | HCINT_STALL | HCINT_BABBLE_ERR)) {
+      if (edpt->hcchar_bm.ep_num != 0 && (hcint & HCINT_XFER_COMPLETE)) {
+        edpt->next_pid = hctsiz.pid; // save pid (already toggled)
+      }
+
       const uint16_t remain_bytes = (uint16_t) hctsiz.xfer_size;
       const uint16_t remain_packets = hctsiz.packet_count;
       const uint16_t actual_len = edpt->buflen - remain_bytes;
@@ -1187,7 +1441,7 @@ static bool handle_channel_in_dma(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hci
           hcchar.odd_frame = 1 - (dwc2->hfnum & 1); // transfer on next frame
           channel->hcchar = hcchar.value;
         }
-        channel_send_in_token(dwc2, channel);
+        channel_send_in_token(dwc2, channel, false);
       }
     } else if (hcint & (HCINT_NAK | HCINT_DATATOGGLE_ERR)) {
       xfer->err_count = 0;
@@ -1204,8 +1458,12 @@ static bool handle_channel_in_dma(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hci
         channel_xfer_in_retry(dwc2, ch_id, hcint);
       }
     } else if (hcint & HCINT_FARME_OVERRUN) {
-      // retry start-split in next binterval
-      channel_xfer_in_retry(dwc2, ch_id, hcint);
+      if (hcchar.ep_type == HCCHAR_EPTYPE_ISOCHRONOUS) {
+        xfer->result = XFER_RESULT_FAILED;
+        is_done      = true;
+      } else {
+        channel_xfer_in_retry(dwc2, ch_id, hcint);
+      }
     }
 
     if (xfer->closing == 1) {
@@ -1234,7 +1492,7 @@ static bool handle_channel_out_dma(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hc
       if (xfer->closing) {
         is_done = true;
       } else {
-        channel_xfer_start(dwc2, ch_id);
+        channel_xfer_start(dwc2, ch_id, false);
       }
     } else if (hcint & (HCINT_XFER_COMPLETE | HCINT_STALL)) {
       is_done = true;
@@ -1248,30 +1506,38 @@ static bool handle_channel_out_dma(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hc
       }
       channel->hcintmsk &= ~HCINT_ACK;
     } else if (hcint & HCINT_XACT_ERR) {
-     if (hcint & (HCINT_NAK | HCINT_NYET | HCINT_ACK)) {
-       xfer->err_count = 0;
-       // clean up transfer so far and start again
-       channel_xfer_out_wrapup(dwc2, ch_id);
-       channel_xfer_start(dwc2, ch_id);
-     } else {
-       xfer->err_count++;
-       if (xfer->err_count >= HCD_XFER_ERROR_MAX) {
-         xfer->result = XFER_RESULT_FAILED;
-         is_done = true;
-       } else {
-         // Rewind, then retry the start-split. Non-periodic SPLIT throttles via channel_disable + re-arm on
-         // the halt (immediate re-fire exhausts the retry budget; the disable gives the hub TT a recovery
-         // gap, like slave). Periodic split is excluded: channel_disable() is a no-op for it, so the halt
-         // never fires and the channel would wedge. Non-split re-inits immediately (Programming Guide 5.1.2.3).
-         channel_xfer_out_wrapup(dwc2, ch_id);
-         if (hcsplt.split_en && !channel_is_periodic(channel->hcchar)) {
-           xfer->retry_disabled = 1;
-           channel_disable(dwc2, channel);
-         } else {
-           channel_xfer_start(dwc2, ch_id);
-         }
-       }
-     }
+      if (hcint & (HCINT_NAK | HCINT_NYET | HCINT_ACK)) {
+        xfer->err_count = 0;
+        // clean up transfer so far and start again
+        channel_xfer_out_wrapup(dwc2, ch_id);
+        channel_xfer_start(dwc2, ch_id, false);
+      } else {
+        xfer->err_count++;
+        if (xfer->err_count >= HCD_XFER_ERROR_MAX) {
+          xfer->result = XFER_RESULT_FAILED;
+          is_done = true;
+        } else {
+          // Rewind, then retry the start-split. Non-periodic SPLIT throttles via channel_disable + re-arm on
+          // the halt (immediate re-fire exhausts the retry budget; the disable gives the hub TT a recovery
+          // gap, like slave). Periodic split is excluded: channel_disable() is a no-op for it, so the halt
+          // never fires and the channel would wedge. Non-split re-inits immediately (Programming Guide 5.1.2.3).
+          channel_xfer_out_wrapup(dwc2, ch_id);
+          if (hcsplt.split_en && !channel_is_periodic(channel->hcchar)) {
+            xfer->retry_disabled = 1;
+            channel_disable(dwc2, channel);
+          } else {
+            channel_xfer_start(dwc2, ch_id, false);
+          }
+        }
+      }
+    } else if (hcint & HCINT_FARME_OVERRUN) {
+      channel_xfer_out_wrapup(dwc2, ch_id);
+      if (edpt->hcchar_bm.ep_type == HCCHAR_EPTYPE_ISOCHRONOUS) {
+        xfer->result = XFER_RESULT_FAILED;
+        is_done      = true;
+      } else {
+        channel_xfer_start(dwc2, ch_id, false);
+      }
     } else if (hcint & HCINT_NYET) {
       if (hcsplt.split_en && hcsplt.split_compl) {
         // split not yet mean hub has no data, retry complete split
@@ -1292,7 +1558,7 @@ static bool handle_channel_out_dma(dwc2_regs_t* dwc2, uint8_t ch_id, uint32_t hc
       // Non-split OUT NAK is core-handled (5.1.2.2), so this is split-only.
       xfer->err_count = 0;
       channel_xfer_out_wrapup(dwc2, ch_id);
-      channel_xfer_start(dwc2, ch_id);
+      channel_xfer_start(dwc2, ch_id, false);
     }
 
     if (xfer->closing == 1) {
@@ -1320,7 +1586,29 @@ static void handle_channel_irq(uint8_t rhport, bool in_isr) {
       dwc2_channel_char_t hcchar = {.value = channel->hcchar};
 
       const uint32_t hcint = channel->hcint;
-      channel->hcint = hcint; // clear interrupt
+      // Slave handlers process one cause per pass. If ChHltd arrived with
+      // another cause, leave it pending so the next pass retires the halt.
+      const uint32_t hcint_clear = (!is_dma && (hcint & ~HCINT_HALTED)) ? (hcint & ~HCINT_HALTED) : hcint;
+      channel->hcint = hcint_clear;
+
+      if (is_dma && xfer->aborting && (hcint & HCINT_HALTED)) {
+        hcd_endpoint_t* edpt = &_hcd_data.edpt[xfer->ep_id];
+        const bool closing = xfer->closing;
+        // channel_xfer_start() predicts the PID after all requested packets;
+        // an aborted transfer may have completed fewer.
+        if (hcchar.ep_type != HCCHAR_EPTYPE_ISOCHRONOUS) {
+          const dwc2_channel_tsize_t hctsiz = {.value = channel->hctsiz};
+          edpt->next_pid = hctsiz.pid;
+        }
+        xfer->aborting = false;
+        channel_dealloc(dwc2, ch_id);
+        if (closing) {
+          edpt_dealloc(edpt);
+        } else {
+          edpt->aborting = 0;
+        }
+        continue;
+      }
 
       bool is_done = false;
       if (is_dma) {
@@ -1373,15 +1661,17 @@ static bool handle_sof_irq(uint8_t rhport, bool in_isr) {
   for(uint8_t ep_id = 0; ep_id < CFG_TUH_DWC2_ENDPOINT_MAX; ep_id++) {
     hcd_endpoint_t *edpt = &_hcd_data.edpt[ep_id];
     if (edpt->closing == 0) {
-      if (edpt->hcchar_bm.enable && channel_is_periodic(edpt->hcchar) && edpt->uframe_countdown > 0) {
-        edpt->uframe_countdown -= tu_min32(ucount, edpt->uframe_countdown);
+      if (edpt->hcchar_bm.enable && channel_is_periodic(edpt->hcchar) && edpt->xfer_pending) {
+        if (edpt->uframe_countdown > 0) {
+          edpt->uframe_countdown -= tu_min32(ucount, edpt->uframe_countdown);
+        }
         if (edpt->uframe_countdown == 0) {
           if (!edpt_xfer_kickoff(dwc2, ep_id)) {
             edpt->uframe_countdown = ucount; // failed to start, try again next frame
           }
         }
 
-        more_isr = true;
+        more_isr = more_isr || edpt->xfer_pending;
       }
     }
   }
@@ -1501,25 +1791,23 @@ void hcd_int_handler(uint8_t rhport, bool in_isr) {
     }
   }
 
-  if (gintsts & GINTSTS_HPRTINT) {
-    // Host port interrupt: source is cleared in HPRT register
-    // TU_LOG1_HEX(dwc2->hprt);
-    handle_hprt_irq(rhport, in_isr);
-  }
-
-  if (gintsts & GINTSTS_HCINT) {
-    // Host Channel interrupt: source is cleared in HCINT register
-    // must be handled after TX FIFO empty
-    handle_channel_irq(rhport, in_isr);
-  }
-
   if (gintsts & GINTSTS_DISCINT) {
-    // Device disconnected
     dwc2->gintsts = GINTSTS_DISCINT;
+    channel_cleanup_on_disconnect(dwc2);
+    hcd_event_device_remove(rhport, in_isr);
 
-    if (0 == (dwc2->hprt & HPRT_CONN_STATUS)) {
-      hcd_event_device_remove(rhport, in_isr);
+    // A fast replug can be visible without a pending connect-detect interrupt.
+    const uint32_t hprt = dwc2->hprt;
+    if (!(hprt & HPRT_CONN_DETECT) && (hprt & HPRT_CONN_STATUS)) {
+      hcd_event_device_attach(rhport, in_isr);
     }
+    return;
+  }
+
+  if (gintsts & GINTSTS_HPRTINT) {
+    // Host port interrupt: source is cleared in HPRT register
+    // TU_LOG1_HEX(dwc2->hprt);
+    handle_hprt_irq(rhport, in_isr);
   }
 
 #if CFG_TUH_DWC2_SLAVE_ENABLE
@@ -1553,6 +1841,13 @@ void hcd_int_handler(uint8_t rhport, bool in_isr) {
     }
   }
 #endif
+
+  // Draining the RxFIFO completion status can assert HCINT.XferCompl. Read
+  // the live status here so the completion is handled in this ISR invocation.
+  if ((dwc2->gintsts & dwc2->gintmsk) & GINTSTS_HCINT) {
+    handle_channel_irq(rhport, in_isr);
+  }
+
 }
 
 #endif
diff --git a/src/tinyusb.mk b/src/tinyusb.mk
index 365043927..c8e943a5a 100644
--- a/src/tinyusb.mk
+++ b/src/tinyusb.mk
@@ -19,6 +19,7 @@ TINYUSB_SRC_C += \
 	src/class/usbtmc/usbtmc_device.c \
 	src/class/video/video_device.c \
 	src/class/vendor/vendor_device.c \
+	src/class/audio/audio_host.c \
   src/host/usbh.c \
   src/host/hub.c \
   src/class/cdc/cdc_host.c \
@@ -26,4 +27,3 @@ TINYUSB_SRC_C += \
   src/class/midi/midi_host.c \
   src/class/midi/midi2_host.c \
   src/class/msc/msc_host.c \
-  src/class/vendor/vendor_host.c \
diff --git a/src/tusb.c b/src/tusb.c
index 78ee7aeda..e1548e8c1 100644
--- a/src/tusb.c
+++ b/src/tusb.c
@@ -274,7 +274,7 @@ bool tu_edpt_validate(const tusb_desc_endpoint_t *desc_ep, tusb_speed_t speed) {
 #endif
 
 bool tu_bind_driver_to_ep_itf(uint8_t driver_id, uint8_t ep2drv[][2], uint8_t itf2drv[], uint8_t itf_max,
-                              const uint8_t *p_desc, uint16_t desc_len) {
+                              uint8_t ep_max, const uint8_t *p_desc, uint16_t desc_len) {
   const uint8_t *desc_end = p_desc + desc_len;
   while (tu_desc_in_bounds(p_desc, desc_end)) {
     const uint8_t desc_type = tu_desc_type(p_desc);
@@ -283,6 +283,7 @@ bool tu_bind_driver_to_ep_itf(uint8_t driver_id, uint8_t ep2drv[][2], uint8_t it
       const uint8_t ep_addr  = ((const tusb_desc_endpoint_t *)p_desc)->bEndpointAddress;
       const uint8_t ep_num   = tu_edpt_number(ep_addr);
       const uint8_t ep_dir   = tu_edpt_dir(ep_addr);
+      TU_ASSERT(ep_num < ep_max);
       ep2drv[ep_num][ep_dir] = driver_id;
     } else if (desc_type == TUSB_DESC_INTERFACE) {
       const tusb_desc_interface_t *desc_itf = (const tusb_desc_interface_t *)p_desc;
diff --git a/src/tusb.h b/src/tusb.h
index 6a30f7c13..2e98dc137 100644
--- a/src/tusb.h
+++ b/src/tusb.h
@@ -28,6 +28,10 @@
 #if CFG_TUH_ENABLED
   #include "host/usbh.h"
 
+  #if CFG_TUH_AUDIO
+    #include "class/audio/audio_host.h"
+  #endif
+
   #if CFG_TUH_HID
     #include "class/hid/hid_host.h"
   #endif
@@ -48,9 +52,6 @@
     #include "class/midi/midi2_host.h"
   #endif
 
-  #if CFG_TUH_VENDOR
-    #include "class/vendor/vendor_host.h"
-  #endif
 #else
   #ifndef tuh_int_handler
   #define tuh_int_handler(...)
diff --git a/src/tusb_option.h b/src/tusb_option.h
index 24f802b73..2aa0c0acf 100644
--- a/src/tusb_option.h
+++ b/src/tusb_option.h
@@ -866,6 +866,10 @@
   { 0x067b, 0x23f3 }  /* GS */
 #endif
 
+#ifndef CFG_TUH_AUDIO
+  #define CFG_TUH_AUDIO  0
+#endif
+
 #ifndef CFG_TUH_HID
   #define CFG_TUH_HID    0
 #endif
@@ -894,9 +898,6 @@
   #define CFG_TUH_MSC    0
 #endif
 
-#ifndef CFG_TUH_VENDOR
-  #define CFG_TUH_VENDOR 0
-#endif
 
 #ifndef CFG_TUH_API_EDPT_XFER
   #define CFG_TUH_API_EDPT_XFER 0
diff --git a/src/typec/usbc.c b/src/typec/usbc.c
index dc59b35be..5b0e4423a 100644
--- a/src/typec/usbc.c
+++ b/src/typec/usbc.c
@@ -31,6 +31,7 @@ static bool _usbc_inited = false;
 
 // if port is initialized
 static bool _port_inited[TUP_TYPEC_RHPORTS_NUM];
+static bool _port_attached[TUP_TYPEC_RHPORTS_NUM];
 
 // Max possible PD size is 262 bytes
 static uint8_t _rx_buf[64] TU_ATTR_ALIGNED(4);
@@ -57,6 +58,11 @@ TU_ATTR_WEAK bool tuc_pd_control_received_cb(uint8_t rhport, pd_header_t const*
   return false;
 }
 
+TU_ATTR_WEAK void tuc_attach_changed_cb(uint8_t rhport, bool attached) {
+  (void) rhport;
+  (void) attached;
+}
+
 TU_ATTR_WEAK void tcd_connect(uint8_t rhport) {
   (void) rhport;
 }
@@ -90,6 +96,7 @@ bool tuc_init(uint8_t rhport, uint32_t port_type) {
   // Initialize stack
   if (!_usbc_inited) {
     tu_memclr(_port_inited, sizeof(_port_inited));
+    tu_memclr(_port_attached, sizeof(_port_attached));
 
     _usbc_q = osal_queue_create(&_usbc_qdef);
     TU_ASSERT(_usbc_q != NULL);
@@ -124,8 +131,14 @@ void tuc_task_ext(uint32_t timeout_ms, bool in_isr) {
     if (!osal_queue_receive(_usbc_q, &event, timeout_ms)) return;
 
     switch (event.event_id) {
-      case TCD_EVENT_CC_CHANGED:
+      case TCD_EVENT_CC_CHANGED: {
+        bool const attached = event.cc_changed.cc_state[0] != 0 || event.cc_changed.cc_state[1] != 0;
+        if (_port_attached[event.rhport] != attached) {
+          _port_attached[event.rhport] = attached;
+          tuc_attach_changed_cb(event.rhport, attached);
+        }
         break;
+      }
 
       case TCD_EVENT_RX_COMPLETE:
         // TODO process message here in ISR, move to thread later
diff --git a/src/typec/usbc.h b/src/typec/usbc.h
index 9fca7da0d..fc4773b07 100644
--- a/src/typec/usbc.h
+++ b/src/typec/usbc.h
@@ -65,6 +65,7 @@ extern void tcd_int_handler(uint8_t rhport);
 
 bool tuc_pd_data_received_cb(uint8_t rhport, pd_header_t const* header, uint8_t const* dobj, uint8_t const* p_end);
 bool tuc_pd_control_received_cb(uint8_t rhport, pd_header_t const* header);
+void tuc_attach_changed_cb(uint8_t rhport, bool attached);
 
 //--------------------------------------------------------------------+
 //