Comment 1 for bug 1891341

For completeness sake, the same issue can lead to a write when the pid is USB_TOKEN_IN:

cat << EOF | ./i386-softmmu/qemu-system-i386 -device nec-usb-xhci \
-trace usb\* -device usb-audio -device usb-storage,drive=mydrive \
-drive id=mydrive,file=null-co://,size=2M,format=raw,if=none \
-nodefaults -nographic -qtest stdio
outl 0xcf8 0x80001014
outw 0xcfc 0x874
outl 0xcf8 0x80001004
outl 0xcfc 0xed1c695e
write 0xd 0x1 0x27
write 0x1d 0x1 0x84
writel 0x87400000040 0xffffd855
writeq 0x87400002000 0xff05140100000000
write 0x3d 0x1 0x27
write 0x4d 0x1 0x2e
write 0x17232 0x1 0x03
write 0x17254 0x1 0x05
write 0x17276 0x1 0x72
write 0x17278 0x1 0x02
write 0x5d 0x1 0x27
write 0x60 0x1 0x2e
write 0x61 0x1 0x72
write 0x62 0x1 0x01
write 0x6d 0x1 0x2e
write 0x6f 0x1 0x01
write 0x2007c 0x1 0xc7
writeq 0x87400002000 0x5c05140100000000
write 0x20070 0x1 0x80
write 0x20071 0x1 0x06
write 0x20073 0x1 0x02
write 0x20077 0x1 0x02
write 0x20078 0x1 0x08
write 0x2007c 0x1 0xfe
write 0x2007d 0x1 0x08
write 0x20080 0x1 0xfe
write 0x20081 0x1 0xff
write 0x20082 0x1 0x0b
write 0x20089 0x1 0x8c
write 0x2008d 0x1 0x04
write 0x2009d 0x1 0x10
writeq 0x87400002000 0x2505ef019e092f00
EOF

==14239==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500030f000 at pc 0x5568a88618fa bp 0x7fff4b8c4be0 sp 0x7fff4b8c43a8
WRITE of size 111 at 0x62500030f000 thread T0
    #0 0x5568a88618f9 in __asan_memcpy
    #1 0x5568aa5f5ed4 in iov_from_buf_full util/iov.c:33:13
    #2 0x5568a9a70041 in iov_from_buf include/qemu/iov.h:49:16
    #3 0x5568a9a70041 in usb_packet_copy hw/usb/core.c:598:9
    #4 0x5568a9a71ad8 in usb_handle_packet hw/usb/core.c:419:9
...

-Alex