diff --git a/sys/bus/u4b/uvc/uvc_ctrls.c b/sys/bus/u4b/uvc/uvc_ctrls.c
--- a/sys/bus/u4b/uvc/uvc_ctrls.c
+++ b/sys/bus/u4b/uvc/uvc_ctrls.c
@@ -922,7 +922,7 @@
 	uint8_t bCtrlSize = 0;
 	uint32_t nctrls = 0;
 	uint8_t *bmCtrls = NULL;
-	uint8_t i = 0;
+	unsigned int i = 0;   /* was uint8_t: wraps at 256 -> infinite loop + heap OOB */
 
 	struct uvc_xu_node_info *node_info_xu = NULL;
 	struct uvc_pu_node_info *node_info_pu = NULL;