Hello Mathias, out of curiosity: could the same happen, too, on the receive side? I can see a similar check in static void xhci_unmap_td_bounce_buffer. rt5572sta e.g. uses for receiving urb->transfer_buffer, too. I can see no problems at all for this path at the moment (not even a warning) - but couldn't this just be chance? Thanks Michael