Another silly mistake, on OUT control requests with a data payload, I forgot to dereference the pointer, so was writing randomly into the stack. Works with keyboard now. (This commit message was relayed through it in fact).