Summary

Two related defects corrupt CDC-NCM transmit once TCP write buffers make TX bursty
(a single txavail poll drains many queued segments back-to-back through
cdcncm_send). This PR fixes both.

1. Buffer-reuse race. cdcncm coalesces datagrams into the single
pre-allocated wrreq->buf that the USB controller transmits directly from, but
cdcncm_send formatted a new NTB batch into it via cdcncm_transmit_format()
without first waiting for the previous transfer to complete — the wrreq_idle
wait happened only later, in cdcncm_transmit_work(). A new batch started while
the previous NTB was still in flight overwrote the in-flight buffer, so the host
dropped the corrupted NTB and TX could wedge (wrreq_idle never reposted).

Fix: acquire wrreq_idle in cdcncm_send when starting a new batch
(dgramcount == 0), before formatting; drop the now-redundant wait in
cdcncm_transmit_work (a second wait on the init-to-1 semaphore would deadlock).

2. Concurrent transmit_work. cdcncm_send runs under the recursive
netdev_lock and calls cdcncm_transmit_work() synchronously in the buffer-full
branch, while a scheduled delaywork instance runs cdcncm_transmit_work() on
ETHWORK — two different threads. Two EP_SUBMITs of the one wrreq corrupt the
IN request queue and leave the IN buffer prepared-but-unarmed (controller idle,
wrreq_idle never reposted).

Fix: wrap cdcncm_transmit_work in netdev_lock (the synchronous caller
already holds this recursive nxrmutex; a delaywork instance blocks until the
drain releases it), plus an empty-batch guard (dgramcount == 0 → return) so a
delaywork that runs after a synchronous flush emptied the batch doesn't seal an
empty NTB and double-submit the in-flight wrreq.

Testing

Validated on RP2350 (Pico 2 W) with CONFIG_NET_TCP_WRITE_BUFFERS=y, as part of
the complete fix set: 144 dense/concurrent HTTP downloads, zero wedges, ~486
KB/s — previously transmit hung within a few requests. Each fix was confirmed
against the specific frozen-state failure signature captured over SWD (corrupted /
prepared-but-unarmed IN buffer, controller idle).

Note: on RP2350, full stability under maximal TX density additionally requires a
memory barrier between the BUFF_STATUS clear and the AVAILABLE re-arm in the
Cortex-M33 USB device driver (a separate change, not included here). The two
cdcncm defects fixed here are real and the fixes correct independent of that
barrier.

Disclosure: this change and its analysis were prepared with the assistance of an
AI agent (Anthropic's Claude, via Claude Code), and validated on-hardware by a
human maintainer before submission.