Correction:
I previously missed this line buried in xhci_invalidate_cancelled_tds():
list_del_init(&td->td_list);
Which means that a TD waiting for Set TR Dequeue cannot be processed by
handle_tx_event() if it completes normally. I don't know whether it's a
good thing or not, but that's what it is today.
Ideally, endpoints just shouldn't run with Set TR Deq pending.
