I was always taught that class/subclass/version in a device descriptor is a hangover from USB 1.0 and that certainly any composite device should have zeroes there as that stuff is defined in the interface descriptors. I've generally put zeroes there even for single interfaces.
But I see a case of a (commercial) composite device that is marked ef/02/01 in the device descriptor, that is, DFU.
Moreover, I see that they are using EP0 with interface class out/in transfers.
But obviously a interface class-specific control transfer needs a class.
And that class should come out of the interface referenced by the wIndex in the control request.
In this case, wIndex is 0 and IF0 is an 01/01/20 Audio control v2.0, not DFU.
Am I missing something or is this just bad usage?