I noticed this in sys/dev/usb/uhidev.c:

usbd_status
uhidev_set_report(struct uhidev *scd, int type, void *data, int len)
{
[ ... ]
	buf = malloc(len + 1, M_TEMP, M_WAITOK);
	buf[0] = scd->sc_report_id;
	memcpy(buf+1, data, len);

	retstat = usbd_set_report(scd->sc_parent->sc_iface, type,
				  scd->sc_report_id, data, len + 1);

	free(buf, M_TEMP);
[ ... ]
}

Shouldn't the call to usbd_set_report() pass buf instead data?
-- 
Name: Dave Huang         |  Mammal, mammal / their names are called /
INet: khym@azeotrope.org |  they raise a paw / the bat, the cat /
FurryMUCK: Dahan         |  dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 28 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++