I've discovered a little more interesting information. After chasing
several items that yielded no positive results, I decided that I
needed to simplify my test case.

If I configure a CTRL endpoint with buffer 0 (OUT buffer) marked as
used, the very first packet (GetStatus according to my sniffer)
transmitted by the host causes all kinds of strange errors. I receive
a UTMI Rx Error interrupt from the device core, and the device core
seems to spew random garbage back to the host.

I expected that this test should cause the device core to simply NAK
the OUT packet from the host.

Does this behavior ring a bell for anyone out there?

Rudi, if you are there, does this sound completely crazy?

I know that I am using a previously untested configuration, but given
the number of things that work properly, this just seems odd. I don't
really see any issues with the protocol engine logic, but then again
I'm no USB expert.