Sorry, I wasn't clear: I'd like to know about encapsulated commands and responses as such (the idea) and how RNDIS and NCM devices handle them.
At some point I got the impression that RNDIS sends data messages by sending the "message header data" to the control EP and the actual raw data to the bulk EP. Or is it just bulk transfer with the bulk data wrapped in message structures?
Encapsulated commands and responses seem to be used quite a lot (internet sticks, tethering), but any descriptions about them seems to be quite hard to find. Most example drivers don't do it, because it's considered too complicated (I think).