138a:0097 (sensor type 0xdb) on ThinkPad T470 — second ENROLL capture resets the chip (Errno 5 → Errno 19) #295

Environment: ThinkPad T470, 138a:0097 "VSI 55E FM209-001", sensor type 0xdb, ROM product 0x30, lines_per_frame 144, bytes_per_line 152, FWExt 1.2 (6_07f_lenovo_mis_qm). python3-validity 0.14ppa1, open-fprintd 0.6ppa1, Python 3.14.4. Kernel/distro: Ubuntu 26.04.1 LTS, kernel 7.0.0-38-generic

Behaviour:

• Factory reset, pairing, fwext upload and calibration all succeed (calib-data.bin is 0 bytes, expected since calibration_iterations = 0 for 0xdb).
• identify() from the playground works reliably, including two consecutive captures in the same session (returns Finger not recognized: 0500b304db as expected with an empty DB).
• enroll() succeeds on the first capture (Enroll progress: 0100140000… is printed), but the second capture(CaptureMode.ENROLL) fails: tls.app(build_cmd_02(ENROLL)) → USBError Errno 5 on bulk read, then the device drops off the bus (Errno 19) and re-enumerates.

Ruled out:

• USB autosuspend (forced power/control=on)
• Timing (a 2 s sleep before each capture)
• ENROLL-specific capture chunks (using the IDENTIFY 0x4e/0x2e chunks for ENROLL still fails on the second capture)
• The per-iteration enrollment_update_end() (0x69 00) (removing it still fails)
• Cold power cycle with the built-in battery disabled

So the chip seems to accept captures fine, except after enrollment_update_start (0x68) + append_new_image (0x6b ×2) on type 0xdb. Happy to run further tests or provide USB traces.