AIKIDO-2026-364175

TL;DR

handle_download() in the experimental device_next USB DFU class (subsys/usb/device_next/class/usbd_dfu.c) computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that buf is non-NULL. A USB host that completes a download with a zero-length DFU_DNLOAD (no Data OUT stage) reaches the handler with a NULL buffer after the device is in DFU_DNLOAD_IDLE, causing a NULL+offset read and a fatal CPU fault. The fix guards the buffer access so a zero-length, NULL-data transfer is passed to the callback instead of crashing.