Hi, there is a dangling pointer in data->urb in function bcm203x_probe in v5.14-rc3 in function bcm203x_probe : 187: data->urb = usb_alloc_urb(0, GFP_KERNEL); ... 205: usb_free_urb(data->urb); 206: return -ENOMEM; leave a dangling pointer here, I'm not sure whether it can be triggered somewhere. Any feedback would be appreciated, thanks :) Best wishes, Nil Yi