xhci_check_transfer decodes a stream ID from the completion TRB, which per xHCI spec carries none — completions on streams endpoints are silently dropped (transfer hang/DoS)

Summary

Transfer-event dwTrb2 bits are remainder/completion-code, not a stream ID (xHCI 1.0 4.11.5.2): the decoded garbage >= XHCI_MAX_STREAMS is silently dropped (or scans the wrong stream then dropped) - in-flight transfers stall until timeout, streams I/O wedges. Requires non-default hw.usb.xhci.streams=1 + SS bulk + USB_FS_OPEN_STREAM; memory-safe (indices bounded, td-address match). Upstream fixed by FreeBSD commit 253c93f26bcf (absent here). stream_id=0 + scan-all-streams fix.