diff --git a/soc/app/dcd_tntusb.c b/soc/app/dcd_tntusb.c
index f91174e..3cb28d7 100644
--- a/soc/app/dcd_tntusb.c
+++ b/soc/app/dcd_tntusb.c
@@ -22,7 +22,7 @@ static g_tntusb_t g_usb;
 static void _usb_data_write(unsigned int dst_ofs, const void *src, int len) {
 	/* FIXME unaligned ofs */
 	const uint32_t *src_u32 = src;
-	volatile uint32_t *dst_u32 = (volatile uint32_t *)((USB_CORE_OFFSET+USB_TXMEM) + dst_ofs);
+	volatile uint32_t *dst_u32 = (volatile uint32_t *)((USB_DATA_BASE) + dst_ofs);

 	len = (len + 3) >> 2;
 	while (len--)
@@ -31,7 +31,7 @@ static void _usb_data_write(unsigned int dst_ofs, const void *src, int len) {

 static void _usb_data_read (void *dst, unsigned int src_ofs, int len) {
 	/* FIXME unaligned ofs */
-	volatile uint32_t *src_u32 = (volatile uint32_t *)((USB_CORE_OFFSET+USB_RXMEM) + src_ofs);
+	volatile uint32_t *src_u32 = (volatile uint32_t *)((USB_DATA_BASE) + src_ofs);
 	uint32_t *dst_u32 = dst;

 	int i = len >> 2;
@@ -172,6 +172,8 @@ bool dcd_edpt_open (uint8_t rhport, tusb_desc_endpoint_t const * desc_edpt) {
 	return true;
 }

+void *g_out_buffer[16];
+
 bool dcd_edpt_xfer (uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t total_bytes) {
 	(void) rhport;

@@ -180,7 +182,8 @@ bool dcd_edpt_xfer (uint8_t rhport, uint8_t ep_addr, uint8_t * buffer, uint16_t
 	printf ("dcd_edpt_xfer: ep %d dir %s, len %d\n", epnum, (dir==TUSB_DIR_OUT)?"out":"in", total_bytes);

 	if (dir==TUSB_DIR_OUT) {
-		if (buffer) _usb_data_read(buffer, tntusb_ep_regs[epnum].out.bd[0].ptr, total_bytes);
+		if (buffer)
+			g_out_buffer[epnum] = buffer;
 		tntusb_ep_regs[epnum].out.bd[0].csr = TNTUSB_BD_STATE_RDY_DATA | TNTUSB_BD_LEN(g_usb.ep_mps[epnum]);
 	} else {
 		if (buffer) _usb_data_write(tntusb_ep_regs[epnum].in.bd[0].ptr, buffer, total_bytes);
@@ -255,13 +258,16 @@ void usb_poll(void) {
 		uint32_t in_csr=tntusb_ep_regs[ep].in.bd[0].csr;
 		if ((in_csr & TNTUSB_BD_STATE_MSK) == TNTUSB_BD_STATE_DONE_OK) {
 			printf("IN xfer done on ep %d: %d bytes\n", ep, g_usb.ep_in_xfer_len[ep]);
-			tntusb_ep_regs[ep].in.bd[0].csr=0;
+			tntusb_ep_regs[ep].in.bd[0].csr = 0;
 			dcd_event_xfer_complete(0, ep, g_usb.ep_in_xfer_len[ep], XFER_RESULT_SUCCESS, true);
 		}
 		uint32_t out_csr=tntusb_ep_regs[ep].out.bd[0].csr;
 		if ((out_csr & TNTUSB_BD_STATE_MSK) == TNTUSB_BD_STATE_DONE_OK) {
-			printf("OUT xfer done on ep %d: %d bytes\n", ep, out_csr & TNTUSB_BD_LEN_MSK);
-			dcd_event_xfer_complete(0, ep, out_csr & TNTUSB_BD_LEN_MSK, XFER_RESULT_SUCCESS, true);
+			int len = (out_csr & TNTUSB_BD_LEN_MSK) - 2;
+			tntusb_ep_regs[ep].out.bd[0].csr = 0;
+			printf("OUT xfer done on ep %d: %d bytes\n", ep, len);
+			_usb_data_read(g_out_buffer[ep], tntusb_ep_regs[ep].out.bd[0].ptr, len);
+			dcd_event_xfer_complete(0, ep, len, XFER_RESULT_SUCCESS, true);
 		}
 	}
 }