disregard the entire thing was a typeo...
APIProcessSets( ReportID ,&ReportData[ReportSize], ReportSize);
vs
APIProcessSets( ReportID ,&ReportData, ReportSize);
I so started at this for so long...
In HID the OUT endpoint is optional. If you don't have one your Windows driver will send a SET_REPORT request to the control endpoint instead.
thx this is what I was seeing.