Regression: Qualcomm bootloader/fastboot device (05c6:9500 hub + 05c6:9501 gadget) fails to enumerate on Pi 5 with 6.12/6.18 kernels; worked on 6.1.54

Reproduce the issue on a Pi 5 with the Qualcomm device, then compare USB hub enumeration and dmesg between kernel 6.1.54 and 6.12.25 or later. Done means the 05c6:9501 gadget enumerates behind the 05c6:9500 hub, fastboot devices detects it, and the repeated hub_ext_port_status errors stop.

Describe the bug

A Qualcomm QCS-based Android device in bootloader (fastboot) mode presents as a 7-port USB 2.0 hub (05c6:9500, no string descriptors) with the fastboot gadget (05c6:9501) behind port 1 of that hub.

On kernel 6.1.54-1+rpt2 (2023-10-10 Raspberry Pi OS), the gadget enumerates and fastboot works. On 6.12.25+rpt, 6.18.34+rpt and 6.18.39+rpt, the hub enumerates but its downstream port never completes reset — the gadget is never seen — and dmesg floods with hub_ext_port_status failed (err = 3) (~2500 msgs/sec, i.e. the hub returns a 3-byte GetPortStatus response).

The device is certainly out-of-spec (the 9501 gadget also advertises bulk endpoint ... invalid maxpacket 8, which 6.1 logs and tolerates), but per the no-regression principle it worked on 6.1 and no combination of usbcore quirks restores it on 6.12+. This likely affects fastboot flashing of other Qualcomm-ABL-based devices from Pi 5 hosts.

Steps to reproduce the behaviour

Connect a Qualcomm QCS/IoT-platform Android device to a Pi 5 via USB.
adb reboot bootloader (device re-enumerates as 05c6:9500 hub).
fastboot devices → empty; observe dmesg.

Device (s)

Raspberry Pi 5

System

Raspberry Pi 5 Model B rev 1.0 (d04170) and rev 1.1 (d04171)
Raspberry Pi OS Bookworm (2023-10-10, 2025-05-13) and Trixie (2026-06-18)
Kernels: 6.1.54-1+rpt2 (good), 6.12.25-1+rpt1 / 6.18.34+rpt / 6.18.39+rpt (bad)
Device: Qualcomm QCS-based Android IoT device ("YUPIKP-IOT-IDP"), Qualcomm ABL bootloader; normal (non-bootloader) ADB mode (18d1:4ee2) enumerates fine on all kernels

Logs

Working case — 6.1.54-1+rpt2, Pi 5 rev 1.0 (d04170)

usb 3-1: New USB device found, idVendor=05c6, idProduct=9500, bcdDevice= 1.00
usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
hub 3-1:1.0: USB hub found
hub 3-1:1.0: 7 ports detected
usb 3-1.1: new high-speed USB device number 49 using xhci-hcd
usb 3-1.1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 8
usb 3-1.1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 8
usb 3-1.1: New USB device found, idVendor=05c6, idProduct=9501, bcdDevice= 1.00

Failing case — 6.12.25+rpt (identical on 6.18.34/6.18.39), Pi 5 rev 1.1 (d04171)

usb 1-1: new high-speed USB device number 29 using xhci-hcd
usb 1-1: New USB device found, idVendor=05c6, idProduct=9500, bcdDevice= 1.00
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-1-port1: attempt power cycle
usb 1-1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-1-port1: unable to enumerate USB device
usb 1-1: device descriptor read/64, error -71
hub 1-1:1.0: hub_ext_port_status failed (err = 3) [repeats ~2500/sec]

Additional context

No response