diff -r 9d75ff1c06a2 -r 424cd62c6887 sys/dev/usb/if_urtwn.c
--- a/sys/dev/usb/if_urtwn.c	Wed Aug 20 18:33:09 2025 +0000
+++ b/sys/dev/usb/if_urtwn.c	Sun Aug 24 09:45:29 2025 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_urtwn.c,v 1.112 2025/07/29 18:58:40 hgutch Exp $	*/
+/*	$NetBSD: if_urtwn.c,v 1.120 2025/08/24 09:45:29 nat Exp $	*/
 /*	$OpenBSD: if_urtwn.c,v 1.42 2015/02/10 23:25:46 mpi Exp $	*/
 
 /*-
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.112 2025/07/29 18:58:40 hgutch Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.120 2025/08/24 09:45:29 nat Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -760,6 +760,7 @@
 			data = &sc->rx_data[j][i];
 
 			data->sc = sc;	/* Backpointer for callbacks. */
+			data->pidx = j;
 
 			error = usbd_create_xfer(sc->rx_pipe[j], URTWN_RXBUFSZ,
 			    0, 0, &data->xfer);
@@ -2554,7 +2555,7 @@
 	size_t pidx = data->pidx;
 	uint32_t rxdw0;
 	uint8_t *buf;
-	int len, totlen, pktlen, infosz, npkts;
+	int len, totlen, pktlen, infosz, npkts, pktspacing;
 
 	URTWNHIST_FUNC(); URTWNHIST_CALLED();
 	DPRINTFN(DBG_RX, "status=%jd", status, 0, 0, 0);
@@ -2591,8 +2592,13 @@
 	if (npkts != 0)
 		rnd_add_uint32(&sc->rnd_source, npkts);
 
+	if (ISSET(sc->chip, URTWN_CHIP_92EU))
+		pktspacing = 8;
+	else
+		pktspacing = 128;
+
 	/* Process all of them. */
-	while (npkts-- > 0) {
+	while (npkts-- > 0 && len > 0) {
 		if (__predict_false(len < (int)sizeof(*stat))) {
 			DPRINTFN(DBG_RX, "len(%jd) is short than header",
 			    len, 0, 0, 0);
@@ -2620,8 +2626,7 @@
 		/* Process 802.11 frame. */
 		urtwn_rx_frame(sc, buf, pktlen);
 
-		/* Next chunk is 128-byte aligned. */
-		totlen = roundup2(totlen, 128);
+		totlen = roundup2(totlen, pktspacing);
 		buf += totlen;
 		len -= totlen;
 	}
@@ -3002,6 +3007,7 @@
 			device_printf(sc->sc_dev,
 			    "unable to transmit packet\n");
 			if_statinc(ifp, if_oerrors);
+			urtwn_put_tx_data(sc, data);
 			continue;
 		}
 		m_freem(m);
@@ -3367,7 +3373,7 @@
 	if (sc->chip & URTWN_CHIP_88E)
 		pktbuf_count = R88E_TXPKTBUF_COUNT;
 	else if (sc->chip & URTWN_CHIP_92EU)
-		pktbuf_count = R88E_TXPKTBUF_COUNT;
+		pktbuf_count = R92E_TXPKTBUF_COUNT;
 	else
 		pktbuf_count = R92C_TXPKTBUF_COUNT;
 
diff -r 9d75ff1c06a2 -r 424cd62c6887 sys/dev/usb/if_urtwnvar.h
--- a/sys/dev/usb/if_urtwnvar.h	Wed Aug 20 18:33:09 2025 +0000
+++ b/sys/dev/usb/if_urtwnvar.h	Sun Aug 24 09:45:29 2025 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_urtwnvar.h,v 1.16 2020/03/15 23:04:51 thorpej Exp $	*/
+/*	$NetBSD: if_urtwnvar.h,v 1.18 2025/08/24 09:45:29 nat Exp $	*/
 /*	$OpenBSD: if_urtwnreg.h,v 1.3 2010/11/16 18:02:59 damien Exp $	*/
 
 /*-
diff -r 9d75ff1c06a2 -r 424cd62c6887 sys/dev/usb/xhci.c
--- a/sys/dev/usb/xhci.c	Wed Aug 20 18:33:09 2025 +0000
+++ b/sys/dev/usb/xhci.c	Sun Aug 24 09:45:29 2025 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: xhci.c,v 1.189 2025/08/02 22:53:47 mlelstv Exp $	*/
+/*	$NetBSD: xhci.c,v 1.190 2025/08/24 09:43:09 nat Exp $	*/
 
 /*
  * Copyright (c) 2013 Jonathan A. Kollasch
@@ -34,7 +34,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xhci.c,v 1.189 2025/08/02 22:53:47 mlelstv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xhci.c,v 1.190 2025/08/24 09:43:09 nat Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -4794,6 +4794,13 @@
 	    XHCI_TRB_3_IOC_BIT;
 	xhci_xfer_put_trb(xx, i++, parameter, status, control);
 
+	if (!isread && (xfer->ux_flags & USBD_FORCE_SHORT_XFER)) {
+		status = XHCI_TRB_2_IRQ_SET(0) |
+		    XHCI_TRB_2_TDSZ_SET(0) |
+		    XHCI_TRB_2_BYTES_SET(0);
+		xhci_xfer_put_trb(xx, i++, parameter, status, control);
+	}
+
 	if (!polling)
 		mutex_enter(&tr->xr_lock);
 	xhci_ring_put_xfer(sc, tr, xx, i);