diff --git a/sys/bus/u4b/input/uep.c b/sys/bus/u4b/input/uep.c
--- a/sys/bus/u4b/input/uep.c
+++ b/sys/bus/u4b/input/uep.c
@@ -223,6 +223,10 @@
 				goto tr_setup;
 
 			res = pkt_len - sc->buf_len;
+			/* Only 'len' bytes of buf were filled by usbd_copy_out; a
+		   short transfer would otherwise read uninitialized stack. */
+			if (res > len)
+				goto tr_setup;
 			memcpy(sc->buf + sc->buf_len, buf, res);
 			uep_process_pkt(sc, sc->buf);
 			sc->buf_len = 0;