Index: firmware/target/arm/usb-drv-pp502x.c
===================================================================
--- firmware/target/arm/usb-drv-pp502x.c	(revision 16230)
+++ firmware/target/arm/usb-drv-pp502x.c	(working copy)
@@ -502,11 +502,11 @@
     td->size_ioc_sts = (len << DTD_LENGTH_BIT_POS) |
         DTD_STATUS_ACTIVE | DTD_IOC;
     td->buff_ptr0 = (unsigned int)ptr;
-    td->buff_ptr1 = (unsigned int)ptr + 0x1000;
-    td->buff_ptr2 = (unsigned int)ptr + 0x2000;
-    td->buff_ptr3 = (unsigned int)ptr + 0x3000;
-    td->buff_ptr4 = (unsigned int)ptr + 0x4000;
-    td->reserved = len;
+    td->buff_ptr1 = (unsigned int)ptr & 0xfffff000 + 0x1000;
+    td->buff_ptr2 = (unsigned int)ptr & 0xfffff000 + 0x2000;
+    td->buff_ptr3 = (unsigned int)ptr & 0xfffff000 + 0x3000;
+    td->buff_ptr4 = (unsigned int)ptr & 0xfffff000 + 0x4000;
+    //td->reserved = len;
     qh->dtd.next_td_ptr = (unsigned int)td;
     qh->dtd.size_ioc_sts &= ~(QH_STATUS_HALT | QH_STATUS_ACTIVE);
 
@@ -608,9 +608,9 @@
     memset(qh_array, 0, sizeof _qh_array);
 
     /*** control ***/
-    qh_array[EP_CONTROL].max_pkt_length = 512 << QH_MAX_PKT_LEN_POS | QH_IOS;
+    qh_array[EP_CONTROL].max_pkt_length = 64 << QH_MAX_PKT_LEN_POS | QH_IOS;
     qh_array[EP_CONTROL].dtd.next_td_ptr = QH_NEXT_TERMINATE;
-    qh_array[EP_CONTROL+1].max_pkt_length = 512 << QH_MAX_PKT_LEN_POS;
+    qh_array[EP_CONTROL+1].max_pkt_length = 64 << QH_MAX_PKT_LEN_POS;
     qh_array[EP_CONTROL+1].dtd.next_td_ptr = QH_NEXT_TERMINATE;
 
     /*** bulk ***/