ccid_write_data_block() initializes every CCID_DataBlock field except
bChainParameter. Since bulk-in buffers are reused without zeroing, a
stale non-zero value can make the guest CCID driver misinterpret a
complete response as chained.

This device never chains responses, so set bChainParameter to 00h as
required by CCID Rev 1.1 section 6.2.1 for TPDU-level exchange.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/usb/dev-smartcard-reader.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index cc7356c77413..208a14dbd1b3 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -848,6 +848,7 @@ static bool ccid_write_data_block(USBCCIDState *s, uint8_t slot, uint8_t seq,
     p->b.hdr.bSeq = seq;
     p->b.bStatus = ccid_calc_status(s);
     p->b.bError = s->bError;
+    p->bChainParameter = 0;
     if (p->b.bError) {
         DPRINTF(s, D_VERBOSE, "error %d\n", p->b.bError);
     }

-- 
2.55.0