“If (bmRequestType & 0x3) == 0, the user-controlled ‘index’ (populated from the lower byte of the wIndex field of the SETUP packet) is used as an index into g_State->usbHandlers without any boundary checks.”
Apple sealed every iPod Nano from the 5th generation up. No firmware dumps, no code execution. The seal was a USB stack in mask ROM that used an attacker-controlled byte as an array index and jumped to whatever it found. The final exploit is a USB packet that doubles as ARM shellcode. Bootrom bugs can’t be patched, so every one of those Nanos stays open forever.