--- a/sys/bus/u4b/usb_request.c
+++ b/sys/bus/u4b/usb_request.c
@@ -1889,7 +1889,17 @@
 	req.wIndex[0] = iface->idesc->bInterfaceNumber;
 	req.wIndex[1] = 0;
 	USETW(req.wLength, size);
-	return (usbd_do_request(udev, lock, &req, d));
+	/*
+	 * Bound the enumeration-time report-descriptor fetch: it runs
+	 * synchronously in driver attach context on the per-bus USB explore
+	 * (hub event) thread -- ucycom_attach() (ucycom.c:231-233), ums, ukbd,
+	 * wsp, uhid, uaudio likewise -- where the default 5 s control timeout
+	 * lets a slow or malicious HID device pin bus-wide device enumeration
+	 * for the full timeout on every insertion.  A functional device
+	 * delivers its report descriptor in milliseconds; 1 s is a generous
+	 * margin.
+	 */
+	return (usbd_do_request_flags(udev, lock, &req, d, 0, NULL, 1000));
 }
 
 /*------------------------------------------------------------------------*