Index: uspace/drv/uhci-hcd/uhci_struct/transfer_descriptor.c
===================================================================
--- uspace/drv/uhci-hcd/uhci_struct/transfer_descriptor.c	(revision 171cd8807faa358a638aa96f6a3e8ed1290ed44f)
+++ uspace/drv/uhci-hcd/uhci_struct/transfer_descriptor.c	(revision 46d12fb875948bb1b240463c65914857b160aaa2)
@@ -69,7 +69,10 @@
 	    || (pid == USB_PID_OUT));
 
+	const uint32_t next_pa = addr_to_phys(next);
+	assert((next_pa & LINK_POINTER_ADDRESS_MASK) == next_pa);
+
 	instance->next = 0
 	    | LINK_POINTER_VERTICAL_FLAG
-	    | ((next != NULL) ? addr_to_phys(next) : LINK_POINTER_TERMINATE_FLAG);
+	    | (next_pa ? next_pa : LINK_POINTER_TERMINATE_FLAG);
 
 	instance->status = 0
@@ -90,9 +93,5 @@
 	    | ((pid & TD_DEVICE_PID_MASK) << TD_DEVICE_PID_POS);
 
-	instance->buffer_ptr = 0;
-
-	if (size) {
-		instance->buffer_ptr = (uintptr_t)addr_to_phys(buffer);
-	}
+	instance->buffer_ptr = addr_to_phys(buffer);
 
 	usb_log_debug2("Created TD(%p): %X:%X:%X:%X(%p).\n",
Index: uspace/drv/uhci-hcd/utils/malloc32.h
===================================================================
--- uspace/drv/uhci-hcd/utils/malloc32.h	(revision 171cd8807faa358a638aa96f6a3e8ed1290ed44f)
+++ uspace/drv/uhci-hcd/utils/malloc32.h	(revision 46d12fb875948bb1b240463c65914857b160aaa2)
@@ -50,4 +50,7 @@
 static inline uintptr_t addr_to_phys(void *addr)
 {
+	if (addr == NULL)
+		return 0;
+
 	uintptr_t result;
 	int ret = as_get_physical_mapping(addr, &result);