the stick talks, and for the first time it’s talking to us, not the bios. this part was the transfer engine: queue heads and transfer descriptors, little linked-list structs the ehci controller fetches out of ram and executes on its own. a control transfer is three of them chained by hand (setup, data, status), data toggles set manually per stage because high-speed lets you. link the queue head into the async ring, poll the active bit, unlink, then ring the doorbell (an actual doorbell bit) so the controller formally forgets the whole thing before the structs get reused. first exchange: GET_DESCRIPTOR at address 0, and the stick answered with its vid/pid like a civilized device. qemu’s stick goes by 46f4:0001; the real one can introduce itself when the laptop’s back. next: scsi over bulk, and fat12 stops caring what a disk is. moral: usb devices are polite, they just want to be asked in struct form.