P33M

Yes, the implication is that use of EPn is unsafe for interrupt or bulk if you're in a noisy environment where a Host ACK could get smashed. Unfortunately that means...

RP2040 Host mode EPx Bulk polling is cumbersome, because as you observed it's not possible to cleanly stop polling the endpoint. Stopping the SIE also runs the risk of dropping...

On RP2040 if the Bulk endpoint is treated as Interrupt, EPx will stop after 1 handshake and you will get a TRANS_COMPLETE interrupt. NAK_REC in SIE_STATUS should be set alonside...

More information is going to be required, as our recommended VScode solution uses openocd and that works. - What commands were being sent - Which command failed?

For more useful diagnostic output, can you boot with `slub_debug=FPUZ` in /boot/firmware/config.txt and provoke a crash?

Could you look at setting bcdVersion to this in tusb_config.h? Some formatting/munging may be required to fit the 0xmm.nn format that USB uses.

Picotool can now retrieve pin configs. This will appear in the next release.

How are you connecting the probe to the target (electrically)?

Sketch your connections.

5MHz definitely isn't going to work with that sort of setup. 30kHz is a bit low but not unsurprising. You have a large loop between SWD/SWCLK and the GND wire...