dcd/ch58x: drop stale EP0 transfer state on SETUP

The PID_SETUP handler armed the new control transfer but left any in-flight EP0
transfer from the previous request marked valid, so a spurious EP0 IN/OUT could run
update_in()/update_out() against stale state (the removed dcd_ch58x_usbfs.c invalidated
both EP0 directions on every SETUP). Clear xfer[0] IN/OUT validity when a SETUP arrives.
Applies to all WCH USBFS parts -- a new SETUP always supersedes a pending control xfer.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

1 files changed, 4 insertions, 0 deletions

diff --git a/src/portable/wch/dcd_ch32_usbfs.c b/src/portable/wch/dcd_ch32_usbfs.c
index 61c973062..18cc17a33 100644
--- a/src/portable/wch/dcd_ch32_usbfs.c
+++ b/src/portable/wch/dcd_ch32_usbfs.c
@@ -363,6 +363,10 @@ void dcd_int_handler(uint8_t rhport) {
         // setup clears stall
         ep_tx_ctrl_set(0, USBFS_EP_T_RES_NAK);
         data.ep0_tog  = true;
+        // A new SETUP supersedes any control transfer still in flight; drop its stale EP0 state so a
+        // spurious EP0 IN/OUT can't run update_in()/update_out() against the previous request.
+        data.xfer[0][TUSB_DIR_OUT].valid = false;
+        data.xfer[0][TUSB_DIR_IN].valid  = false;
 
         uint8_t *ep0_out = ep_out_buf(0);
         const tusb_control_request_t *setup = (const tusb_control_request_t *)ep0_out;