diff --git a/components/odrive_ascii/web/hid_visualizer.html b/components/odrive_ascii/web/hid_visualizer.html
index 5a0da898b..7cb8c0b29 100644
--- a/components/odrive_ascii/web/hid_visualizer.html
+++ b/components/odrive_ascii/web/hid_visualizer.html
@@ -809,8 +809,22 @@ <h2>Log <span class="spacer"></span><button id="clearLogBtn" class="small">Clear
         ["Collections", String((dev.collections || []).length)],
         ["Input reports", String(model.byId.size)],
       ];
-      els.devInfo.innerHTML = rows.map((r) =>
-        `<div class="row"><span class="k">${r[0]}</span><span class="v">${r[1]}</span></div>`).join("");
+      // Build with DOM nodes + textContent: productName comes from the device
+      // descriptor and is attacker-controlled, so it must never be
+      // interpolated into innerHTML (a malicious device name could inject
+      // active markup into the page).
+      els.devInfo.replaceChildren(...rows.map((r) => {
+        const row = document.createElement("div");
+        row.className = "row";
+        const k = document.createElement("span");
+        k.className = "k";
+        k.textContent = r[0];
+        const v = document.createElement("span");
+        v.className = "v";
+        v.textContent = r[1];
+        row.append(k, v);
+        return row;
+      }));
     }
 
     async function disconnect() {
diff --git a/components/odrive_ascii/web/odrive_control_panel.html b/components/odrive_ascii/web/odrive_control_panel.html
index d7a4a9c14..5d860a5f3 100644
--- a/components/odrive_ascii/web/odrive_control_panel.html
+++ b/components/odrive_ascii/web/odrive_control_panel.html
@@ -510,35 +510,56 @@ <h2>Device</h2>
     //      decode(Uint8Array)->number|bigint|boolean. ----
     const TYPES = {
       bool:   { size: 1, dec: (dv) => dv.getUint8(0) !== 0, enc: (v) => { const b = new Uint8Array(1); b[0] = boolFrom(v) ? 1 : 0; return b; }, num: (x) => (x ? 1 : 0) },
-      int8:   { size: 1, dec: (dv) => dv.getInt8(0),  enc: (v) => i(1, (dv, n) => dv.setInt8(0, n), v),  num: (x) => x },
-      uint8:  { size: 1, dec: (dv) => dv.getUint8(0), enc: (v) => i(1, (dv, n) => dv.setUint8(0, n), v), num: (x) => x },
-      int16:  { size: 2, dec: (dv) => dv.getInt16(0, true),  enc: (v) => i(2, (dv, n) => dv.setInt16(0, n, true), v),  num: (x) => x },
-      uint16: { size: 2, dec: (dv) => dv.getUint16(0, true), enc: (v) => i(2, (dv, n) => dv.setUint16(0, n, true), v), num: (x) => x },
-      int32:  { size: 4, dec: (dv) => dv.getInt32(0, true),  enc: (v) => i(4, (dv, n) => dv.setInt32(0, n, true), v),  num: (x) => x },
-      uint32: { size: 4, dec: (dv) => dv.getUint32(0, true), enc: (v) => i(4, (dv, n) => dv.setUint32(0, n, true), v), num: (x) => x },
-      int64:  { size: 8, dec: (dv) => dv.getBigInt64(0, true),  enc: (v) => big(8, (dv, n) => dv.setBigInt64(0, n, true), v),  num: (x) => Number(x) },
-      uint64: { size: 8, dec: (dv) => dv.getBigUint64(0, true), enc: (v) => big(8, (dv, n) => dv.setBigUint64(0, n, true), v), num: (x) => Number(x) },
-      float:  { size: 4, dec: (dv) => dv.getFloat32(0, true), enc: (v) => { const b = new Uint8Array(4); new DataView(b.buffer).setFloat32(0, parseFloat(v), true); return b; }, num: (x) => x },
+      int8:   { size: 1, dec: (dv) => dv.getInt8(0),  enc: (v) => i(1, (dv, n) => dv.setInt8(0, n), v, -128, 127),  num: (x) => x },
+      uint8:  { size: 1, dec: (dv) => dv.getUint8(0), enc: (v) => i(1, (dv, n) => dv.setUint8(0, n), v, 0, 255), num: (x) => x },
+      int16:  { size: 2, dec: (dv) => dv.getInt16(0, true),  enc: (v) => i(2, (dv, n) => dv.setInt16(0, n, true), v, -32768, 32767),  num: (x) => x },
+      uint16: { size: 2, dec: (dv) => dv.getUint16(0, true), enc: (v) => i(2, (dv, n) => dv.setUint16(0, n, true), v, 0, 65535), num: (x) => x },
+      int32:  { size: 4, dec: (dv) => dv.getInt32(0, true),  enc: (v) => i(4, (dv, n) => dv.setInt32(0, n, true), v, -2147483648, 2147483647),  num: (x) => x },
+      uint32: { size: 4, dec: (dv) => dv.getUint32(0, true), enc: (v) => i(4, (dv, n) => dv.setUint32(0, n, true), v, 0, 4294967295), num: (x) => x },
+      int64:  { size: 8, dec: (dv) => dv.getBigInt64(0, true),  enc: (v) => big(8, (dv, n) => dv.setBigInt64(0, n, true), v, -(2n ** 63n), 2n ** 63n - 1n),  num: (x) => Number(x) },
+      uint64: { size: 8, dec: (dv) => dv.getBigUint64(0, true), enc: (v) => big(8, (dv, n) => dv.setBigUint64(0, n, true), v, 0n, 2n ** 64n - 1n), num: (x) => Number(x) },
+      float:  { size: 4, dec: (dv) => dv.getFloat32(0, true), enc: (v) => f32(v), num: (x) => x },
       endpoint_ref: { size: 4, dec: (dv) => `#${dv.getUint16(0, true)}:0x${dv.getUint16(2, true).toString(16)}`, enc: null, num: null },
     };
     function boolFrom(v) { return /^(1|true|on|yes|y)$/i.test(String(v).trim()); }
-    function i(size, set, v) {
+    // These values command motors, so encoding is STRICT: the whole string must
+    // parse and fit the target type -- no partial parses ("1abc"), no NaN, no
+    // truncation ("1.9" as an int) and no wrap (uint8 300). writeEndpoint
+    // surfaces the thrown message to the user instead of transmitting garbage.
+    function i(size, set, v, min, max) {
+      const s = String(v).trim();
+      if (!/^[+-]?\d+$/.test(s)) throw new Error("'" + v + "' is not a valid integer");
+      const n = Number(s);
+      if (!Number.isSafeInteger(n) || n < min || n > max)
+        throw new Error("'" + v + "' is out of range [" + min + ", " + max + "]");
       const b = new Uint8Array(size);
-      let n = Math.trunc(Number(v));
-      if (!Number.isFinite(n)) n = 0;
       set(new DataView(b.buffer), n);
       return b;
     }
-    function big(size, set, v) {
-      const b = new Uint8Array(size);
+    function big(size, set, v, min, max) {
+      const s = String(v).trim();
       let n;
-      // Throw on a non-integer string (e.g. "1.5") instead of silently
-      // writing 0 to the device; writeEndpoint surfaces the message.
-      try { n = BigInt(String(v).trim()); }
+      try { n = BigInt(s); }
       catch (_) { throw new Error("'" + v + "' is not a valid integer"); }
+      if (n < min || n > max)
+        throw new Error("'" + v + "' is out of range [" + min + ", " + max + "]");
+      const b = new Uint8Array(size);
       set(new DataView(b.buffer), n);
       return b;
     }
+    function f32(v) {
+      const s = String(v).trim();
+      if (!/^[+-]?(\d+\.?\d*|\.\d+)([eE][+-]?\d+)?$/.test(s))
+        throw new Error("'" + v + "' is not a valid number");
+      const n = parseFloat(s);
+      // Math.fround tells us what the wire's float32 will hold; a finite
+      // double that rounds to +/-Infinity in float32 would overflow.
+      if (!Number.isFinite(n) || !Number.isFinite(Math.fround(n)))
+        throw new Error("'" + v + "' overflows float32");
+      const b = new Uint8Array(4);
+      new DataView(b.buffer).setFloat32(0, n, true);
+      return b;
+    }
     function typeInfo(t) { return TYPES[t] || null; }
     function isPlottable(ep) {
       const ti = typeInfo(ep.type);
@@ -703,7 +724,10 @@ <h2>Device</h2>
       if (!found) throw new Error("no vendor-specific (0xFF) interface with a bulk IN+OUT endpoint pair was found");
       await device.claimInterface(found.interfaceNumber);
       if (found.alternateSetting !== 0) {
-        try { await device.selectAlternateInterface(found.interfaceNumber, found.alternateSetting); } catch (_) {}
+        // The chosen endpoints belong to this alternate; if selecting it fails
+        // they are not active, so let the rejection propagate and fail the
+        // connect (instead of reporting Connected with dead endpoints).
+        await device.selectAlternateInterface(found.interfaceNumber, found.alternateSetting);
       }
       ifaceNumber = found.interfaceNumber;
       epIn = found.inEp.endpointNumber; epOut = found.outEp.endpointNumber;
@@ -763,14 +787,22 @@ <h2>Device</h2>
 
     async function readPacket(readLen, timeoutMs) {
       let timer = null;
+      // WebUSB transfers are NOT cancelable: on timeout the transferIn below
+      // stays pending and would consume a LATER response, permanently
+      // desyncing the link. On timeout we silence the abandoned promise and
+      // tag the error so transact() runs recoverLink(), whose device.reset()
+      // aborts the pending transfer for real.
+      const xfer = device.transferIn(epIn, readLen);
       const timeout = new Promise((_, reject) => {
-        timer = setTimeout(async () => {
-          try { await device.clearHalt("in", epIn); } catch (_) {}
-          reject(new Error("response timeout (" + timeoutMs + "ms)"));
+        timer = setTimeout(() => {
+          xfer.catch(() => {}); // rejects when recoverLink() resets the device
+          const e = new Error("response timeout (" + timeoutMs + "ms)");
+          e.needsRecovery = true;
+          reject(e);
         }, timeoutMs);
       });
       try {
-        const result = await Promise.race([device.transferIn(epIn, readLen), timeout]);
+        const result = await Promise.race([xfer, timeout]);
         if (result.status === "stall") {
           try { await device.clearHalt("in", epIn); } catch (_) {}
           throw new Error("IN endpoint stalled");
@@ -784,18 +816,25 @@ <h2>Device</h2>
       } finally { if (timer) clearTimeout(timer); }
     }
 
-    // Best-effort resync after a desync (e.g. sequence mismatch): drain one
-    // stray IN packet if the device has one queued, then clear the IN halt so
-    // the next transaction starts from a clean endpoint. Never throws.
-    async function resyncIn() {
-      if (!device || epIn === null) return;
+    // Recover a desynced link (response timeout / sequence mismatch). WebUSB
+    // transfers cannot be canceled, so draining or clearing halts cannot
+    // reliably resynchronize -- an abandoned transferIn keeps competing for
+    // the next response. Instead reset the device: that aborts every pending
+    // transfer (their promises reject) and returns the endpoints to a clean
+    // state, with the browser restoring the configuration and interface
+    // claims. If even the reset fails, close the connection so the UI
+    // reflects reality instead of silently misbehaving.
+    async function recoverLink(reason) {
+      if (!device) return;
+      logLine("err", "Recovering link (" + reason + "): resetting device...");
       try {
-        const drain = new Promise((resolve) =>
-          device.transferIn(epIn, inPacketSize).then(resolve, resolve));
-        const timeout = new Promise((resolve) => setTimeout(resolve, 50));
-        await Promise.race([drain, timeout]);
-      } catch (_) {}
-      try { await device.clearHalt("in", epIn); } catch (_) {}
+        await device.reset();
+        logLine("sys", "Device reset complete; link resynchronized.");
+      } catch (e) {
+        logLine("err", "Device reset failed (" + e.message + "); disconnecting.");
+        manualDisconnect = false;
+        await safeClose();
+      }
     }
 
     // Send one request packet and await its one response packet. Returns the
@@ -828,13 +867,18 @@ <h2>Device</h2>
             // resync the link by draining any straggler packet + clearing the
             // IN halt. Transactions are serialized, so this runs to completion
             // before the next one starts.
-            logLine("err", `Sequence mismatch: sent ${req.seq}, got ${respSeq & 0x7fff} (link desynced); resyncing.`);
-            await resyncIn();
+            logLine("err", `Sequence mismatch: sent ${req.seq}, got ${respSeq & 0x7fff} (link desynced).`);
+            await recoverLink("sequence mismatch");
             return null;
           }
           return resp.subarray(2);
         } catch (e) {
-          if (!manualDisconnect) logLine("err", "Transaction failed: " + e.message);
+          if (!manualDisconnect) {
+            logLine("err", "Transaction failed: " + e.message);
+            // A timed-out read leaves an uncancelable transferIn pending;
+            // reset the device before the next transaction runs.
+            if (e && e.needsRecovery) await recoverLink(e.message);
+          }
           return null;
         }
       });
diff --git a/components/odrive_ascii/web/odrive_webusb_console.html b/components/odrive_ascii/web/odrive_webusb_console.html
index 91a48ccc6..1981ce92a 100644
--- a/components/odrive_ascii/web/odrive_webusb_console.html
+++ b/components/odrive_ascii/web/odrive_webusb_console.html
@@ -762,10 +762,12 @@ <h2>Misc</h2>
       }
 
       await device.claimInterface(found.interfaceNumber);
-      // Select the alternate setting if it isn't the default (0).
+      // Select the alternate setting if it isn't the default (0). The chosen
+      // endpoints belong to this alternate; if selecting it fails they are not
+      // active, so let the rejection propagate to the connect failure handler
+      // (instead of reporting Connected while every transfer fails).
       if (found.alternateSetting !== 0) {
-        try { await device.selectAlternateInterface(found.interfaceNumber, found.alternateSetting); }
-        catch (_) { /* some platforms don't require/allow this; ignore */ }
+        await device.selectAlternateInterface(found.interfaceNumber, found.alternateSetting);
       }
 
       ifaceNumber = found.interfaceNumber;
diff --git a/components/usb_device/example/.gitignore b/components/usb_device/example/.gitignore
new file mode 100644
index 000000000..9be075a5e
--- /dev/null
+++ b/components/usb_device/example/.gitignore
@@ -0,0 +1,3 @@
+# Runtime artifacts for the USB hardware probe (odrive_usb_probe.py); never committed.
+odrive-ref/
+.venv-usb/
diff --git a/components/usb_device/example/CMakeLists.txt b/components/usb_device/example/CMakeLists.txt
index 75be2e1bd..8a7c3ace3 100644
--- a/components/usb_device/example/CMakeLists.txt
+++ b/components/usb_device/example/CMakeLists.txt
@@ -19,12 +19,13 @@ set(EXTRA_COMPONENT_DIRS
   "../../../components/hid-rp"
   "../../../components/logger"
   "../../../components/odrive_ascii"
+  "../../../components/odrive_native"
   "../../../components/usb_device"
 )
 
 set(
   COMPONENTS
-  "main esptool_py base_component format hid-rp logger odrive_ascii usb_device esp_tinyusb"
+  "main esptool_py base_component format hid-rp logger odrive_ascii odrive_native usb_device esp_tinyusb"
   CACHE STRING
   "List of components to include"
   )
diff --git a/components/usb_device/example/HARDWARE_TEST.md b/components/usb_device/example/HARDWARE_TEST.md
new file mode 100644
index 000000000..2edf62aee
--- /dev/null
+++ b/components/usb_device/example/HARDWARE_TEST.md
@@ -0,0 +1,92 @@
+# Hardware test: ODrive-compatible USB device (ASCII on CDC + native/Fibre on vendor)
+
+This example makes an ESP32-S3 (or -S2/-P4) enumerate as an **ODrive-compatible
+USB device** on its native USB-OTG peripheral, presenting two interfaces from one
+simulated motor state:
+
+- **CDC serial** → the **ODrive ASCII** protocol (text; terminal / the Web Serial console).
+- **vendor (0xFF, WebUSB)** → the **ODrive native (Fibre) binary** protocol — the one
+  `odrivetool` / the `fibre` library auto-discover over USB.
+
+VID/PID default to `0x1209 / 0x0d32` (ODrive v3-like). The log console stays on the
+built-in USB-Serial-JTAG, separate from this device.
+
+> Board note: on single-USB-connector S3 devkits the USB-OTG and USB-Serial-JTAG
+> share pins. Use a board that exposes the USB-OTG D+/D- (a second connector or the
+> OTG header), or set the console to UART, so the native USB device enumerates.
+
+## 1. Flash
+
+```sh
+cd components/usb_device/example
+idf.py set-target esp32s3
+idf.py -p <PORT> flash monitor
+```
+The monitor prints the endpoint-tree size + `json_crc` once USB is up.
+
+## 2. Verify the native (Fibre) interface over USB — the real gate
+
+`odrivetool` from `pip install odrive` (0.6+) uses the **new** libfibre/protocol and
+will **not** talk to this legacy-protocol device. Use the **reference legacy fibre**
+(pure python), which is exactly what the codec targets and what the interop harness
+already clones.
+
+```sh
+# libusb + a venv with pyusb (the fibre USB backend uses pyusb)
+brew install libusb                      # macOS  (Linux: apt install libusb-1.0-0)
+python3 -m venv .venv-usb && . .venv-usb/bin/activate
+pip install pyusb appdirs
+
+# run the probe -- it fetches the reference fibre for you with --clone
+python odrive_usb_probe.py --clone
+```
+The reference fibre is pure-python (only needs pyserial/pyusb). `--clone` shallow-
+clones ODrive `fw-v0.5.1` into `./odrive-ref` and uses `Firmware/fibre/python` from
+it. Alternatives to `--clone`:
+- if you've already run `components/odrive_native/interop/run.sh`, the probe
+  **auto-detects** the clone it made — just `python odrive_usb_probe.py`;
+- or clone it yourself and point at it:
+  ```sh
+  git clone --depth 1 -b fw-v0.5.1 https://github.com/odriverobotics/ODrive /tmp/odrive-ref
+  python odrive_usb_probe.py --fibre-path /tmp/odrive-ref/Firmware/fibre/python
+  ```
+
+Expected: it discovers the board over USB, downloads endpoint 0, enumerates
+`vbus_voltage / axis0.* / serial_number`, reads values, and writes-then-reads
+`input_pos` and `vel_limit` — `ALL PROBE ASSERTIONS PASSED`.
+
+On **Linux** you may need `sudo` or a udev rule to claim the vendor interface. On
+**Windows** the device must bind WinUSB (the firmware advertises MS-OS-2.0, so it
+should bind automatically).
+
+Legacy `odrivetool` (`pip install 'odrive==0.5.6'` in a Python ≤3.10 env) should also
+auto-discover it as `odrv0`; the reference-fibre probe above avoids that install.
+
+## 3. Verify the ASCII interface (CDC)
+
+The device also shows up as a **serial/CDC port**. Send ODrive ASCII lines with any
+terminal, e.g. `r axis0.encoder.pos_estimate`, `p 0 1.0`, `f 0`. Or open the hosted
+**Web Serial console** and pick this CDC port. (Writes/setpoints are silent by
+default — ODrive semantics; only `r`/`f` respond.)
+
+## 4. Verify WebUSB (browser)
+
+Open `components/odrive_ascii/web/odrive_control_panel.html` (native-protocol control
+panel) in Chromium and Connect; it claims the vendor interface directly (no driver) and
+shows the endpoint tree with live reads/plots. The firmware's WebUSB landing-page
+descriptor also points a browser at the hosted console.
+
+## 5. Verify the HID gamepad (WebHID)
+
+The device also enumerates as a **HID gamepad**: the firmware animates both analog
+sticks and toggles two buttons at ~10 Hz. Your OS will see a gamepad. To visualize the
+input reports directly in the browser, open `components/odrive_ascii/web/hid_visualizer.html`
+in Chromium and Connect (pick the espp gamepad) — you should see the sticks circling and
+buttons blinking. WebHID reads the HID interface directly (no driver); it works on the
+same composite device without disturbing the CDC/vendor interfaces.
+
+## What "good" looks like
+- The USB probe prints the full endpoint tree and `ALL PROBE ASSERTIONS PASSED`.
+- The CDC port answers `r`/`f`.
+- If all three work, the ASCII + native + USB stack is validated end-to-end on real
+  hardware — then it's safe to open the PRs.
diff --git a/components/usb_device/example/README.md b/components/usb_device/example/README.md
index 8048f102a..0417f4391 100644
--- a/components/usb_device/example/README.md
+++ b/components/usb_device/example/README.md
@@ -1,19 +1,29 @@
-# USB Device (CDC + Vendor/WebUSB) + ODrive ASCII Example
+# ODrive-compatible USB Device Example (CDC + Vendor/WebUSB + HID)
 
-This example demonstrates a **composite** `espp::UsbDevice` that exposes both a
-**CDC-ACM serial** interface and a **vendor-specific / WebUSB** interface, both
-wired to the transport-agnostic `espp::OdriveAscii` protocol server. The device
-enumerates with an ODrive-like VID/PID (0x1209 / 0x0d32), separate from the log
-console which stays on the USB-Serial-JTAG peripheral.
+This example demonstrates a **composite** `espp::UsbDevice` that presents an
+ODrive-compatible device with three interfaces, all backed by one simulated motor
+state (matching how a real ODrive splits its protocols across interfaces):
 
-Both interfaces carry the identical raw ODrive ASCII byte stream: RX from either
-interface is fed to `process_bytes()`, and the response is written back out the
-same interface.
+- **CDC-ACM serial** → the **ODrive ASCII** protocol (`espp::OdriveAscii`; text,
+  for a terminal or the Web Serial console).
+- **vendor-specific (class 0xFF, WebUSB)** → the **ODrive native / Fibre binary**
+  protocol (`espp::OdriveNative`) — the one `odrivetool` / the `fibre` library
+  auto-discover and speak over USB.
+- **HID** → an animated **gamepad** input device (built with the `hid-rp`
+  component; visualize it with the WebHID `hid_visualizer.html`).
+
+The device enumerates with an ODrive-like VID/PID (0x1209 / 0x0d32), separate from
+the log console which stays on the USB-Serial-JTAG peripheral.
+
+Each protocol server is transport-agnostic: the CDC RX callback feeds bytes to
+`OdriveAscii::process_bytes()`, the vendor RX callback feeds bytes to
+`OdriveNative::process_bytes()`, and each writes its response back out the same
+interface. The HID interface periodically pushes gamepad input reports.
 
 <!-- markdown-toc start - Don't edit this section. Run M-x markdown-toc-refresh-toc -->
 **Table of Contents**
 
-- [USB Device (CDC + Vendor/WebUSB) + ODrive ASCII Example](#usb-device-cdc--vendorwebusb--odrive-ascii-example)
+- [ODrive-compatible USB Device Example (CDC + Vendor/WebUSB + HID)](#odrive-compatible-usb-device-example-cdc--vendorwebusb--hid)
   - [Requirements](#requirements)
   - [Build](#build)
   - [Flash and Monitor](#flash-and-monitor)
@@ -29,12 +39,13 @@ same interface.
 - The IDF component manager is enabled for this example so it can fetch the
   managed `espressif/esp_tinyusb` component.
 
-The example's `sdkconfig.defaults` enables both the CDC and vendor classes:
+The example's `sdkconfig.defaults` enables the CDC, vendor, and HID classes:
 
 ```
 CONFIG_TINYUSB_CDC_ENABLED=y
 CONFIG_TINYUSB_CDC_COUNT=1
 CONFIG_TINYUSB_VENDOR_COUNT=1
+CONFIG_TINYUSB_HID_COUNT=1
 ```
 
 ## Build
@@ -55,12 +66,13 @@ idf.py flash monitor
 ```
 
 The native USB-OTG connector will appear on the host as a new composite device:
-a serial port (CDC) plus a vendor interface (WebUSB), manufacturer "espp",
-product "espp ODrive ASCII".
+a serial port (CDC), a vendor interface (WebUSB), and a HID gamepad, with
+manufacturer "espp" and product "espp ODrive".
 
 ## Usage
 
-Serial: open the CDC serial port and send ODrive ASCII commands, e.g. from Python:
+**CDC serial (ODrive ASCII):** open the CDC serial port and send ODrive ASCII
+commands, e.g. from Python:
 
 ```python
 import serial
@@ -71,20 +83,33 @@ ser.write(b'p 0 1.0 0.5 0.1\n'); print(ser.readline())
 ser.write(b'f 0\n'); print(ser.readline())
 ```
 
-WebUSB: from a Chromium-based browser, open the WebUSB console and connect to the
-vendor interface (class 0xFF, bulk IN + bulk OUT). The same ODrive ASCII commands
-work over the vendor byte stream. The BOS/WebUSB descriptors point to a
-configurable landing-page URL (default: the espp docs-hosted ODrive WebUSB
-console).
+(Writes/setpoints are silent by default — ODrive semantics; only `r`/`f` respond.)
+
+**Vendor / WebUSB (ODrive native / Fibre):** the vendor interface (class 0xFF,
+bulk IN + bulk OUT) speaks the ODrive native binary protocol. `odrivetool` / the
+reference `fibre` library discover it over USB and read/write the endpoint tree;
+or, from a Chromium-based browser, open the native-protocol WebUSB control panel
+(`odrive_control_panel.html`) and connect. The BOS/WebUSB descriptors point to a
+configurable landing-page URL. See `HARDWARE_TEST.md` and `odrive_usb_probe.py`.
+
+**HID (gamepad):** the device also enumerates as a HID gamepad whose sticks and
+buttons the firmware animates. Your OS will see a gamepad; to inspect the raw
+input reports in the browser, open the WebHID `hid_visualizer.html` in Chromium
+and connect.
 
 ## How it works
 
 - `espp::UsbDevice` installs the TinyUSB driver and builds descriptors for the
-  enabled CDC + vendor functions, allocating interfaces / endpoints sequentially.
+  enabled CDC + vendor + HID functions, allocating interfaces / endpoints
+  sequentially (the S3 USB-OTG endpoint budget fits CDC + vendor + HID).
 - The vendor function advertises WebUSB + MS OS 2.0 descriptors so a browser (and
   Windows, via WinUSB) can bind it driverlessly.
-- Each interface's receive callback feeds incoming bytes to
-  `espp::OdriveAscii::process_bytes()` and writes the response back out that same
-  interface (`write_cdc()` / `write_vendor()`).
+- The CDC receive callback feeds bytes to `espp::OdriveAscii::process_bytes()` and
+  writes the response back out via `write_cdc()`; the vendor receive callback feeds
+  bytes to `espp::OdriveNative::process_bytes()` and writes back via
+  `write_vendor()`. Both servers share one simulated motor state.
+- The HID report descriptor is built with the `hid-rp` component
+  (`espp::GamepadInputReport`); the main loop animates the state and pushes reports
+  with `write_hid_report()` when the HID interface is ready.
 - The log console remains on the USB-Serial-JTAG peripheral (see
   `sdkconfig.defaults.esp32s3`).
diff --git a/components/usb_device/example/main/CMakeLists.txt b/components/usb_device/example/main/CMakeLists.txt
index 7ab15b919..181b27a42 100644
--- a/components/usb_device/example/main/CMakeLists.txt
+++ b/components/usb_device/example/main/CMakeLists.txt
@@ -1,5 +1,5 @@
 idf_component_register(
   SRC_DIRS "."
   INCLUDE_DIRS "."
-  REQUIRES usb_device odrive_ascii hid-rp esp_tinyusb
+  REQUIRES usb_device odrive_ascii odrive_native hid-rp esp_tinyusb
 )
diff --git a/components/usb_device/example/main/usb_cdc_example.cpp b/components/usb_device/example/main/usb_cdc_example.cpp
index 910c7bb79..14decad5e 100644
--- a/components/usb_device/example/main/usb_cdc_example.cpp
+++ b/components/usb_device/example/main/usb_cdc_example.cpp
@@ -11,6 +11,7 @@
 
 #include "logger.hpp"
 #include "odrive_ascii.hpp"
+#include "odrive_native.hpp"
 #include "usb_device.hpp"
 
 // hid-rp: build the HID gamepad report descriptor + serialize input reports.
@@ -24,44 +25,48 @@ extern "C" void app_main(void) {
 
   // The log console stays on the built-in USB-Serial-JTAG / UART (configured via
   // sdkconfig). The native USB device created below is a *separate* USB
-  // peripheral that exposes a composite CDC serial + vendor/WebUSB + HID gamepad
-  // device. CDC and vendor both feed the ODrive ASCII protocol; the HID function
-  // presents an animated gamepad.
-  Logger logger({.tag = "UsbDeviceExample", .level = Logger::Verbosity::INFO});
+  // peripheral that presents an ODrive-compatible device with TWO protocols on
+  // TWO interfaces (matching how a real ODrive splits them), plus a HID gamepad:
+  //   - CDC serial interface  -> ODrive ASCII protocol (text; terminal / WebSerial)
+  //   - vendor interface (0xFF, WebUSB) -> ODrive native (Fibre) binary protocol,
+  //     which is what odrivetool / the fibre library auto-discover over USB.
+  //   - HID interface -> an animated gamepad (visualize with hid_visualizer.html)
+  Logger logger({.tag = "OdriveUsbExample", .level = Logger::Verbosity::INFO});
 
   //! [usb_cdc_example]
 
-  // Simulated motor state driven by the ODrive ASCII commands.
+  // One simulated motor state, shared by both protocol servers.
   struct {
-    float position = 0.0f;
-    float velocity = 0.0f;
-    float torque = 0.0f;
+    std::atomic<float> vbus{24.0f};
+    std::atomic<float> position{0.0f};
+    std::atomic<float> velocity{0.0f};
+    std::atomic<float> torque{0.0f};
+    std::atomic<float> vel_limit{20.0f};
+    std::atomic<uint32_t> error{0};
+    std::atomic<uint64_t> serial{0xA1B2C3D4E5ULL};
   } state;
 
-  // Transport-agnostic ODrive ASCII protocol server. Both USB interfaces feed
-  // the same server.
-  OdriveAscii::Config proto_cfg;
-  proto_cfg.log_level = Logger::Verbosity::WARN;
-  OdriveAscii proto(proto_cfg);
-
-  // Register a couple of demo properties and command callbacks (mirrors the
-  // odrive_ascii example).
-  proto.register_float_property(
-      "axis0.encoder.pos_estimate", [&]() { return state.position; },
+  // --- ASCII protocol server (CDC / terminal / WebSerial) -------------------
+  OdriveAscii::Config ascii_cfg;
+  ascii_cfg.log_level = Logger::Verbosity::WARN;
+  OdriveAscii ascii(ascii_cfg);
+  ascii.register_float_property(
+      "axis0.encoder.pos_estimate", [&]() { return state.position.load(); },
       [&](float v, std::error_code &ec) {
         ec.clear();
         state.position = v;
         return true;
       });
-  proto.register_float_property("axis0.encoder.vel_estimate", [&]() { return state.velocity; });
-  proto.register_float_property(
-      "axis0.controller.input_pos", [&]() { return state.position; },
+  ascii.register_float_property("axis0.encoder.vel_estimate",
+                                [&]() { return state.velocity.load(); });
+  ascii.register_float_property(
+      "axis0.controller.input_pos", [&]() { return state.position.load(); },
       [&](float v, std::error_code &ec) {
         ec.clear();
         state.position = v;
         return true;
       });
-  proto.on_position_command([&](int axis, float pos, std::optional<float> vel_ff,
+  ascii.on_position_command([&](int axis, float pos, std::optional<float> vel_ff,
                                 std::optional<float> torque_ff, std::error_code &ec) {
     (void)axis;
     ec.clear();
@@ -72,34 +77,57 @@ extern "C" void app_main(void) {
       state.torque = *torque_ff;
     return true;
   });
-  proto.on_feedback_request([&](int axis, float &pos_out, float &vel_out, std::error_code &ec) {
+  ascii.on_feedback_request([&](int axis, float &pos_out, float &vel_out, std::error_code &ec) {
     (void)axis;
     ec.clear();
-    pos_out = state.position;
-    vel_out = state.velocity;
+    pos_out = state.position.load();
+    vel_out = state.velocity.load();
     return true;
   });
 
-  // Composite native USB device: CDC serial + vendor-specific (WebUSB) function.
-  // We create it *before* wiring the RX callbacks so the callbacks can capture
-  // the instance and write the response back out the *same* interface.
+  // --- Native (Fibre) protocol server (vendor interface / odrivetool) -------
+  // Register an ODrive-style endpoint tree; odrivetool / the fibre library
+  // download this tree from endpoint 0 and read/write it by numeric id.
+  OdriveNative::Config native_cfg;
+  native_cfg.log_level = Logger::Verbosity::WARN;
+  OdriveNative native(native_cfg);
+  native.register_float_property("vbus_voltage", [&]() { return state.vbus.load(); });
+  native.register_uint32_property("axis0.error", [&]() { return state.error.load(); });
+  native.register_float_property("axis0.encoder.pos_estimate",
+                                 [&]() { return state.position.load(); });
+  native.register_float_property("axis0.encoder.vel_estimate",
+                                 [&]() { return state.velocity.load(); });
+  native.register_float_property(
+      "axis0.controller.input_pos", [&]() { return state.position.load(); },
+      [&](float v, std::error_code &ec) {
+        ec.clear();
+        state.position = v;
+        return true;
+      });
+  native.register_float_property(
+      "axis0.controller.config.vel_limit", [&]() { return state.vel_limit.load(); },
+      [&](float v, std::error_code &ec) {
+        ec.clear();
+        state.vel_limit = v;
+        return true;
+      });
+  native.register_uint64_property("serial_number", [&]() { return state.serial.load(); });
+
+  // --- Composite native USB device ------------------------------------------
   UsbDevice::Config usb_cfg;
   usb_cfg.vid = 0x1209; // pid.codes VID used by ODrive
-  usb_cfg.pid = 0x0d32; // ODrive-like PID
+  usb_cfg.pid = 0x0d32; // ODrive v3-like PID
   usb_cfg.manufacturer = "espp";
-  usb_cfg.product = "espp ODrive ASCII";
+  usb_cfg.product = "espp ODrive";
   usb_cfg.serial_number = "0001";
   usb_cfg.log_level = Logger::Verbosity::INFO;
 
-  // CDC serial function.
   UsbDevice::CdcFunction cdc;
-  cdc.interface_name = "espp ODrive CDC";
+  cdc.interface_name = "espp ODrive ASCII (CDC)";
   usb_cfg.cdc = cdc;
 
-  // Vendor-specific function with WebUSB so a browser can talk to it driverlessly.
-  // The landing page defaults to the espp docs-hosted ODrive WebUSB console.
   UsbDevice::VendorFunction vendor;
-  vendor.interface_name = "espp ODrive WebUSB";
+  vendor.interface_name = "espp ODrive native (Fibre)";
   vendor.webusb = true; // advertise BOS / WebUSB / MS OS 2.0 descriptors
   usb_cfg.vendor = vendor;
 
@@ -130,16 +158,23 @@ extern "C" void app_main(void) {
 
   UsbDevice usb(usb_cfg);
 
-  // Wire: CDC RX -> proto.process_bytes -> CDC write.
+  // CDC RX -> ASCII protocol -> CDC write.
   usb.set_cdc_receive_callback([&](std::span<const uint8_t> data) {
-    auto response = proto.process_bytes(data);
+    auto response = ascii.process_bytes(data);
     if (!response.empty())
       usb.write_cdc(response);
   });
 
-  // Wire: Vendor RX -> proto.process_bytes -> Vendor write (identical payload).
+  // Vendor RX -> native (Fibre) protocol -> vendor write.
+  //
+  // The Fibre packet protocol over USB relies on USB transfer boundaries: each
+  // host bulk-OUT transfer is exactly one packet. odrivetool's requests are
+  // small (< 64 B), so each vendor RX callback delivers one whole packet, which
+  // is what process_bytes() expects. (If a future client sent packets larger
+  // than a single bulk transfer, this callback would need a length-based
+  // reassembly step.)
   usb.set_vendor_receive_callback([&](std::span<const uint8_t> data) {
-    auto response = proto.process_bytes(data);
+    auto response = native.process_bytes(data);
     if (!response.empty())
       usb.write_vendor(response);
   });
@@ -149,35 +184,37 @@ extern "C" void app_main(void) {
     logger.error("Failed to initialize USB device: {}", ec.message());
     return;
   }
-  logger.info("Native USB device ready (CDC serial + vendor/WebUSB + HID gamepad).");
-  logger.info("Serial: connect to the ODrive-like port and send commands, e.g.");
-  logger.info("  'r axis0.encoder.pos_estimate' or 'p 0 1.0 0.5 0.1'");
-  logger.info("WebUSB: open the browser console and connect to the vendor interface.");
-  logger.info("HID: the host sees a live gamepad with animated sticks + toggling buttons.");
+  logger.info("ODrive-compatible native USB device ready:");
+  logger.info("  CDC serial interface  -> ODrive ASCII  (terminal / WebSerial)");
+  logger.info("  vendor interface (WebUSB) -> ODrive native/Fibre (odrivetool over USB)");
+  logger.info("  HID interface -> animated gamepad (visualize with hid_visualizer.html)");
+  logger.info("Native endpoint tree ({} bytes, json_crc=0x{:04x})", native.json().size(),
+              native.json_crc());
 
   //! [usb_cdc_example]
 
-  // The CDC / vendor transports run off the TinyUSB task and their RX callbacks.
-  // Here on the main task we animate the HID gamepad and push an input report a
-  // few times a second so the host sees a live device.
+  // The CDC / vendor transports run off the TinyUSB task + their RX callbacks.
+  // Here on the main task we animate the shared motor state (seen by the ASCII /
+  // native clients) and push a HID gamepad input report a few times a second.
   float phase = 0.0f;
   size_t tick = 0;
   while (true) {
-    // Animate the two joysticks (values in [-1, 1]) and toggle a couple of
-    // buttons at different rates.
+    // Animate the motor state so native / ASCII clients see live values.
+    state.velocity = 0.5f * std::sin(phase);
+
+    // Animate the two joysticks (values in [-1, 1]) and toggle a couple of buttons.
     const float lx = std::sin(phase);
     const float ly = std::cos(phase);
     const float rx = std::cos(phase);
     const float ry = std::sin(phase);
-    const bool button_a = ((tick / 5) % 2) == 0;  // toggles ~1 Hz at 10 Hz loop
-    const bool button_b = ((tick / 10) % 2) == 0; // toggles ~0.5 Hz
+    const bool button_a = ((tick / 5) % 2) == 0;  // ~1 Hz at the 10 Hz loop
+    const bool button_b = ((tick / 10) % 2) == 0; // ~0.5 Hz
 
     gamepad.reset();
     gamepad.set_left_joystick(lx, ly);
     gamepad.set_right_joystick(rx, ry);
     gamepad.set_button(1, button_a);
     gamepad.set_button(2, button_b);
-
     if (usb.is_hid_ready()) {
       auto report = gamepad.get_report();
       std::error_code hid_ec;
@@ -186,11 +223,10 @@ extern "C" void app_main(void) {
         logger.warn_rate_limited("HID report send failed: {}", hid_ec.message());
     }
 
-    // Log the values we send once per second (the loop runs at ~10 Hz).
-    if ((tick % 10) == 0) {
-      logger.info("HID gamepad: lx={:+.2f} ly={:+.2f} rx={:+.2f} ry={:+.2f} A={} B={} ready={}", lx,
-                  ly, rx, ry, button_a, button_b, usb.is_hid_ready());
-    }
+    // Log once per second (the loop runs at ~10 Hz).
+    if ((tick % 10) == 0)
+      logger.info("HID lx={:+.2f} ly={:+.2f} A={} B={} | motor pos={} vel={}", lx, ly, button_a,
+                  button_b, state.position.load(), state.velocity.load());
 
     phase += 0.1f;
     ++tick;
diff --git a/components/usb_device/example/odrive_usb_probe.py b/components/usb_device/example/odrive_usb_probe.py
new file mode 100644
index 000000000..2aaa58112
--- /dev/null
+++ b/components/usb_device/example/odrive_usb_probe.py
@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+"""Hardware probe: talk to the flashed espp ODrive USB example over its native
+(Fibre) *vendor* interface, using the GENUINE legacy pure-python ``fibre`` library
+from ODrive ``fw-v0.5.1`` -- the exact reference the espp ``odrive_native`` codec
+was built against, and the code odrivetool uses.
+
+This is the USB sibling of ``components/odrive_native/interop/odrive_fibre_client.py``
+(which uses a serial/PTY loopback): here we discover the real board over USB, download
+endpoint 0, enumerate the object tree, read values, and write-then-read-back.
+
+Prereqs (host):
+  - libusb (macOS: ``brew install libusb``; Linux: ``apt install libusb-1.0-0``)
+  - a venv with ``pyusb`` + ``appdirs`` (the reference fibre USB backend uses pyusb)
+  - the reference fibre package (pass ``--fibre-path <ODrive>/Firmware/fibre/python``;
+    the interop harness already clones it to
+    ``components/odrive_native/interop/odrive-ref/Firmware/fibre/python``)
+  - on Linux you may need a udev rule / sudo to claim the vendor interface.
+
+Usage:
+  python odrive_usb_probe.py \
+      --fibre-path ../../odrive_native/interop/odrive-ref/Firmware/fibre/python
+"""
+import argparse
+import os
+import subprocess
+import sys
+import time
+
+# The reference legacy fibre (pure python) lives in the ODrive repo at fw-v0.5.1.
+FIBRE_REPO = "https://github.com/odriverobotics/ODrive.git"
+FIBRE_TAG = "fw-v0.5.1"
+FIBRE_SUBPATH = os.path.join("Firmware", "fibre", "python")
+
+
+def log(msg):
+    print("[probe] " + msg, flush=True)
+
+
+def find_fibre_path(explicit):
+    """Return a dir containing the `fibre` package, or None.
+
+    Checks the explicit --fibre-path first, then well-known locations: the clone
+    the odrive_native interop harness makes, a clone next to this script, and /tmp.
+    """
+    here = os.path.dirname(os.path.abspath(__file__))
+    candidates = []
+    if explicit:
+        candidates.append(explicit)
+    candidates += [
+        # cloned by components/odrive_native/interop/run.sh (git-ignored):
+        os.path.join(here, "..", "..", "odrive_native", "interop", "odrive-ref", *FIBRE_SUBPATH.split(os.sep)),
+        os.path.join(here, "odrive-ref", *FIBRE_SUBPATH.split(os.sep)),
+        os.path.join(here, "ODrive", *FIBRE_SUBPATH.split(os.sep)),
+        os.path.join("/tmp", "odrive-ref", *FIBRE_SUBPATH.split(os.sep)),
+    ]
+    for c in candidates:
+        if os.path.isdir(os.path.join(c, "fibre")):
+            return os.path.abspath(c)
+    return None
+
+
+def clone_fibre():
+    """Shallow-clone the reference fibre into ./odrive-ref next to this script."""
+    here = os.path.dirname(os.path.abspath(__file__))
+    dest = os.path.join(here, "odrive-ref")
+    log("cloning reference fibre: %s @ %s -> %s" % (FIBRE_REPO, FIBRE_TAG, dest))
+    subprocess.check_call([
+        "git", "clone", "--depth", "1", "--branch", FIBRE_TAG,
+        "--filter=blob:none", "--sparse", FIBRE_REPO, dest,
+    ])
+    subprocess.check_call(["git", "-C", dest, "sparse-checkout", "set", FIBRE_SUBPATH])
+    return os.path.join(dest, *FIBRE_SUBPATH.split(os.sep))
+
+
+def main():
+    ap = argparse.ArgumentParser(
+        description="Probe the flashed espp ODrive USB device over its native (Fibre) "
+                    "vendor interface using the reference legacy fibre library.")
+    ap.add_argument("--fibre-path", default=None,
+                    help="path to Firmware/fibre/python (auto-detected if omitted)")
+    ap.add_argument("--clone", action="store_true",
+                    help="git-clone the reference fibre next to this script if not found")
+    ap.add_argument("--timeout", type=float, default=15.0)
+    args = ap.parse_args()
+
+    fibre_path = find_fibre_path(args.fibre_path)
+    if fibre_path is None and args.clone:
+        try:
+            fibre_path = clone_fibre()
+        except Exception as e:
+            log("clone failed: %r" % e)
+    if fibre_path is None:
+        log("reference fibre library not found.")
+        log("It is pure-python (only needs pyserial/pyusb). Get it either way:")
+        log("  1) re-run with --clone   (clones it next to this script), or")
+        log("  2) git clone --depth 1 -b %s %s /tmp/odrive-ref" % (FIBRE_TAG, FIBRE_REPO))
+        log("     then: --fibre-path /tmp/odrive-ref/%s" % FIBRE_SUBPATH)
+        log("  (if you have run components/odrive_native/interop/run.sh, it is auto-detected)")
+        return 3
+    sys.path.insert(0, fibre_path)
+
+    try:
+        import fibre  # noqa: F401
+        from fibre import find_any
+        from fibre.utils import Logger
+    except Exception as e:
+        log("FAILED to import the reference fibre from %s: %r" % (fibre_path, e))
+        return 3
+
+    log("fibre reference library: %s" % fibre.__file__)
+    log("discovering over USB (find_any(path='usb', timeout=%ss))..." % args.timeout)
+    log("(if this hangs: check libusb is installed and the board isn't held by another")
+    log(" process; on Linux you may need sudo / a udev rule to claim the vendor interface)")
+
+    dev = find_any(path="usb", timeout=args.timeout, logger=Logger(verbose=False))
+    if dev is None:
+        log("FAILED: no ODrive-like USB device discovered within %ss" % args.timeout)
+        return 1
+
+    log("CONNECTED over USB. Endpoint tree downloaded from endpoint 0:")
+
+    def walk(members, prefix=""):
+        out = []
+        for m in members:
+            name = m.get("name")
+            full = (prefix + "." + name) if prefix else name
+            if m.get("type") == "object":
+                out.append((full, "object", None))
+                out.extend(walk(m.get("members", []), full))
+            else:
+                out.append((full, m.get("type"), m.get("access", "")))
+        return out
+
+    tree = walk(dev.__dict__.get("_json_data", []))
+    for full, typ, access in tree:
+        log("  %-40s %s" % (full, "(object)" if typ == "object" else "%-8s %s" % (typ, access)))
+
+    props = {full for (full, typ, _a) in tree if typ != "object"}
+    required = {
+        "vbus_voltage", "axis0.error",
+        "axis0.encoder.pos_estimate", "axis0.encoder.vel_estimate",
+        "axis0.controller.input_pos", "axis0.controller.config.vel_limit",
+        "serial_number",
+    }
+    missing = required - props
+    if missing:
+        log("FAILED: endpoint tree missing %s" % sorted(missing))
+        return 1
+    log("endpoint tree contains all %d expected properties" % len(required))
+
+    def get(path):
+        obj = dev
+        for p in path.split(".")[:-1]:
+            obj = getattr(obj, p)
+        return getattr(obj, path.split(".")[-1])
+
+    def set_(path, value):
+        obj = dev
+        parts = path.split(".")
+        for p in parts[:-1]:
+            obj = getattr(obj, p)
+        setattr(obj, parts[-1], value)
+
+    vbus = get("vbus_voltage")
+    log("READ  vbus_voltage = %r" % vbus)
+    if abs(vbus - 24.0) > 0.5:
+        log("FAILED: vbus_voltage expected ~24.0, got %r" % vbus)
+        return 1
+    log("READ  serial_number = 0x%X" % get("serial_number"))
+    log("READ  axis0.error = %r" % get("axis0.error"))
+    log("READ  axis0.encoder.vel_estimate = %r (animated on the device)" %
+        get("axis0.encoder.vel_estimate"))
+
+    for path, val in (("axis0.controller.input_pos", 3.14159),
+                      ("axis0.controller.config.vel_limit", 42.5)):
+        log("WRITE %s <- %r" % (path, val))
+        set_(path, val)
+        time.sleep(0.1)
+        rb = get(path)
+        log("READ  %s = %r" % (path, rb))
+        if abs(rb - val) > 1e-4:
+            log("FAILED: %s read-back %r != written %r" % (path, rb, val))
+            return 1
+
+    log("ALL PROBE ASSERTIONS PASSED (real fibre client <-> flashed espp board over USB)")
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        rc = main()
+    except Exception:
+        import traceback
+        traceback.print_exc()
+        rc = 2
+    sys.exit(rc)
diff --git a/components/usb_device/example/sdkconfig.defaults b/components/usb_device/example/sdkconfig.defaults
index 5512a8e8d..022cca595 100644
--- a/components/usb_device/example/sdkconfig.defaults
+++ b/components/usb_device/example/sdkconfig.defaults
@@ -1,3 +1,9 @@
+# This example uses the native USB-OTG peripheral, which is only available on the
+# ESP32-S3 (also S2 / P4) -- NOT the classic ESP32. Pin the target here so a bare
+# `idf.py build` (without an explicit `set-target`) does not fall back to esp32
+# and fail to compile the USB device.
+CONFIG_IDF_TARGET="esp32s3"
+
 # Common ESP-related
 CONFIG_ESP_SYSTEM_EVENT_TASK_STACK_SIZE=4096
 CONFIG_ESP_MAIN_TASK_STACK_SIZE=8192