diff --git a/hw/xbox/nv2a_vsh.c b/hw/xbox/nv2a_vsh.c
index 42aaac90da..254ccd428a 100644
--- a/hw/xbox/nv2a_vsh.c
+++ b/hw/xbox/nv2a_vsh.c
@@ -31,10 +31,10 @@
 
 #include "hw/xbox/nv2a_vsh.h"
 
+#define VSH_D3DSCM_CORRECTION 96
 
 #define VSH_TOKEN_SIZE 4
 
-
 typedef enum {
     FLD_ILU = 0,
     FLD_MAC,
diff --git a/hw/xbox/nv2a_vsh.h b/hw/xbox/nv2a_vsh.h
index ed8e35d049..a2f2abce05 100644
--- a/hw/xbox/nv2a_vsh.h
+++ b/hw/xbox/nv2a_vsh.h
@@ -36,9 +36,6 @@
 // Xbox vertex read/write shader
 #define VSH_VERSION_XVSW                   0x7778
 
-
-#define VSH_D3DSCM_CORRECTION 96
-
 QString* vsh_translate(uint16_t version,
                        uint32_t *tokens, unsigned int tokens_length);
 
diff --git a/hw/xbox/xid.c b/hw/xbox/xid.c
index 95cdaa830a..e7badb773d 100644
--- a/hw/xbox/xid.c
+++ b/hw/xbox/xid.c
@@ -227,6 +227,7 @@ static void usb_xid_handle_control(USBDevice *dev, USBPacket *p,
     case ClassInterfaceRequest | HID_GET_REPORT:
         DPRINTF("xid GET_REPORT %x\n", value);
         if (value == 0x100) { /* input */
+            assert(s->in_state.bLength <= length);
             memcpy(data, &s->in_state, s->in_state.bLength);
             p->actual_length = s->in_state.bLength;
         } else {
@@ -241,6 +242,7 @@ static void usb_xid_handle_control(USBDevice *dev, USBPacket *p,
     case InterfaceRequestVendor | USB_REQ_GET_DESCRIPTOR:
         DPRINTF("xid GET_DESCRIPTOR %x\n", value);
         if (value == 0x4200) {
+            assert(s->xid_desc->bLength <= length);
             memcpy(data, s->xid_desc, s->xid_desc->bLength);
             p->actual_length = s->xid_desc->bLength;
         } else {