--- sys/bus/u4b/usb_handle_request.c	2026-06-29 12:51:18.000000000 +0000
+++ usb_handle_request.c	2026-10-04 18:57:21.744140100 +0000
@@ -743,7 +743,12 @@
 	}
 	/* subtract offset from length */
 
-	max_len -= off;
+	if (max_len < off) {
+		/* length wrapped around - avoid underflow */
+		max_len = 0;
+	} else {
+		max_len -= off;
+	}
 
 	/* Compute the real maximum length */