===== baseline (stock usb_make_raw_desc() classification) =====
DF-5553 structural table check — usb_template_phone.c
======================================================

== (1) usb_make_raw_desc() CDC/IAD patcher replay ==
  MISFIRE ppRawDesc     [0] bLength=10 type=0x24 subtype=0x01 -> patched as CDC CALL MANAGEMENT: byte[4] (bDataInterface slot) += 0
  MISFIRE ppRawDesc     [5] bLength=11 type=0x24 subtype=0x06 -> patched as CDC UNION: byte[3] (bMasterInterface) += 0, byte[4] (bSlaveInterface[0]) += 0
  MISFIRE ppRawDesc     [6] bLength=11 type=0x24 subtype=0x06 -> patched as CDC UNION: byte[3] (bMasterInterface) += 0, byte[4] (bSlaveInterface[0]) += 0
  iface#0 alt0 class=1 sub=1 iInterface=1
  iface#1 alt0 class=1 sub=2 iInterface=3
  MISFIRE ppRawDesc     [0] bLength= 7 type=0x24 subtype=0x01 -> patched as CDC CALL MANAGEMENT: byte[4] (bDataInterface slot) += 1  <-- CORRUPTED
  iface#1 alt1 class=1 sub=2 iInterface=3 (alt)
  iface#2 alt0 class=1 sub=2 iInterface=2
  MISFIRE ppRawDesc     [0] bLength= 7 type=0x24 subtype=0x01 -> patched as CDC CALL MANAGEMENT: byte[4] (bDataInterface slot) += 2  <-- CORRUPTED
  iface#2 alt1 class=1 sub=2 iInterface=2 (alt)
  iface#3 alt0 class=3 sub=0 iInterface=5
  -> HID interface number: 3
PASS S6 phone_get_vendor_desc() hardcodes wIndex==3 (phone.c:379) and the numbering walk produces exactly 3

== structural invariants ==
PASS S1 phone_raw_desc_0: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_1: bLength(0x0c) == sizeof(table) (12) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_2: bLength(0x0c) == sizeof(table) (12) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_3: bLength(0x09) == sizeof(table) (9) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_4: bLength(0x09) == sizeof(table) (9) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_5: bLength(0x0b) == sizeof(table) (11) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_6: bLength(0x0b) == sizeof(table) (11) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_20: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_21: bLength(0x0b) == sizeof(table) (11) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_22: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_30: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_31: bLength(0x0b) == sizeof(table) (11) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_raw_desc_32: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 phone_hid_raw_desc_0: bLength(0x09) == sizeof(table) (9) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S2 phone_raw_iface_0_desc: NULL terminator at slot 7 of 8 — no interior hole
PASS S2 phone_raw_iface_1_desc: NULL terminator at slot 2 of 3 — no interior hole
PASS S2 phone_raw_ep_1_desc: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 phone_raw_iface_2_desc: NULL terminator at slot 2 of 3 — no interior hole
PASS S2 phone_raw_ep_2_desc: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 phone_hid_desc_0: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 phone_iface_1_ep: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 phone_iface_2_ep: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 phone_iface_3_ep: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 phone_interfaces: NULL terminator at slot 6 of 7 — no interior hole
PASS S2 phone_configs: NULL terminator at slot 1 of 2 — no interior hole
PASS S3 usb_string_lang_en: bLength=4 type=0x03 bData=2 bytes (even) — self-sized by USB_MAKE_STRING_DESC (usb.h:569)
PASS S3 string_phone_mixer: bLength=32 type=0x03 bData=30 bytes (even) — self-sized by USB_MAKE_STRING_DESC (usb.h:569)
PASS S3 string_phone_record: bLength=34 type=0x03 bData=32 bytes (even) — self-sized by USB_MAKE_STRING_DESC (usb.h:569)
PASS S3 string_phone_playback: bLength=38 type=0x03 bData=36 bytes (even) — self-sized by USB_MAKE_STRING_DESC (usb.h:569)
PASS S3 string_phone_product: bLength=34 type=0x03 bData=32 bytes (even) — self-sized by USB_MAKE_STRING_DESC (usb.h:569)
PASS S3 string_phone_hid: bLength=28 type=0x03 bData=26 bytes (even) — self-sized by USB_MAKE_STRING_DESC (usb.h:569)
PASS S4 phone_get_string_desc(0x0409, idx): non-NULL exactly for 0..5, NULL for 6..255 (bound check phone.c:412)
PASS S4 non-0x0409 lang_id -> NULL for all non-zero indexes (phone.c:409-411)
PASS S4 index 0 returns LANG table regardless of lang_id (USB-spec correct, phone.c:406-408)
PASS S5 GET_DESCRIPTOR(HID report, iface 3): *plen=39 == sizeof(phone_hid_descriptor)=39
PASS S5 wDescriptorLength embedded in phone_hid_raw_desc_0 (0x0027) == *plen
PASS S5 non-matching requests (iface 0/1/2/4, type 0x21/0x23, index!=0, reqtype 0x80) all -> NULL
PASS S7 mps tables: FULL/HIGH nonzero and in-bounds of mps[USB_SPEED_MAX]; LOW/VARIABLE/SUPER -> 0 -> core fails closed (usb_template.c:221-229)

======================================================
ALL STRUCTURAL CHECKS PASSED (file is clean on S1-S7; the MISFIRE lines above are DF-5553: bDelay 1->2 (iface 1) and 1->3 (iface 2) are real nonzero deltas; three iface-0 misfires add 0)

===== fix-logic check (CDC patch gated on CDC interface classes) =====
MISFIRE lines under FIX_CLASSGATE: 0 (expected 0)