--- a/sys/dev/usb/if_urtwn.c	Wed Aug 20 18:33:09 2025 +0000
+++ b/sys/dev/usb/if_urtwn.c	Sun Aug 24 09:45:29 2025 +0000
@@ -760,6 +760,7 @@
 			data = &sc->rx_data[j][i];
 
 			data->sc = sc;	/* Backpointer for callbacks. */
+			data->pidx = j;
 
 			error = usbd_create_xfer(sc->rx_pipe[j], URTWN_RXBUFSZ,
 			    0, 0, &data->xfer);
@@ -2554,7 +2555,7 @@
 	size_t pidx = data->pidx;
 	uint32_t rxdw0;
 	uint8_t *buf;
-	int len, totlen, pktlen, infosz, npkts;
+	int len, totlen, pktlen, infosz, npkts, pktspacing;
 
 	URTWNHIST_FUNC(); URTWNHIST_CALLED();
 	DPRINTFN(DBG_RX, "status=%jd", status, 0, 0, 0);
@@ -2591,8 +2592,13 @@
 	if (npkts != 0)
 		rnd_add_uint32(&sc->rnd_source, npkts);
 
+	if (ISSET(sc->chip, URTWN_CHIP_92EU))
+		pktspacing = 8;
+	else
+		pktspacing = 128;
+
 	/* Process all of them. */
-	while (npkts-- > 0) {
+	while (npkts-- > 0 && len > 0) {
 		if (__predict_false(len < (int)sizeof(*stat))) {
 			DPRINTFN(DBG_RX, "len(%jd) is short than header",
 			    len, 0, 0, 0);
@@ -2620,8 +2626,7 @@
 		/* Process 802.11 frame. */
 		urtwn_rx_frame(sc, buf, pktlen);
 
-		/* Next chunk is 128-byte aligned. */
-		totlen = roundup2(totlen, 128);
+		totlen = roundup2(totlen, pktspacing);
 		buf += totlen;
 		len -= totlen;
 	}
@@ -3002,6 +3007,7 @@
 			device_printf(sc->sc_dev,
 			    "unable to transmit packet\n");
 			if_statinc(ifp, if_oerrors);
+			urtwn_put_tx_data(sc, data);
 			continue;
 		}
 		m_freem(m);
@@ -3367,7 +3373,7 @@
 	if (sc->chip & URTWN_CHIP_88E)
 		pktbuf_count = R88E_TXPKTBUF_COUNT;
 	else if (sc->chip & URTWN_CHIP_92EU)
-		pktbuf_count = R88E_TXPKTBUF_COUNT;
+		pktbuf_count = R92E_TXPKTBUF_COUNT;
 	else
 		pktbuf_count = R92C_TXPKTBUF_COUNT;
 
--- a/sys/dev/usb/xhci.c	Wed Aug 20 18:33:09 2025 +0000
+++ b/sys/dev/usb/xhci.c	Sun Aug 24 09:45:29 2025 +0000
@@ -4794,6 +4794,13 @@
 	    XHCI_TRB_3_IOC_BIT;
 	xhci_xfer_put_trb(xx, i++, parameter, status, control);
 
+	if (!isread && (xfer->ux_flags & USBD_FORCE_SHORT_XFER)) {
+		status = XHCI_TRB_2_IRQ_SET(0) |
+		    XHCI_TRB_2_TDSZ_SET(0) |
+		    XHCI_TRB_2_BYTES_SET(0);
+		xhci_xfer_put_trb(xx, i++, parameter, status, control);
+	}
+
 	if (!polling)
 		mutex_enter(&tr->xr_lock);
 	xhci_ring_put_xfer(sc, tr, xx, i);