It's pretty straightforward to send a data payload over EP0; you just set USB_currentTD.pData and .count and then execute USB_InitControlRead(). You are doing the sending so you don't have to wait for the transfer to complete, but you do have to make sure the value sticks around (i.e. isn't on the stack).
ACKing a vendor-specific OUT transfer without any data is also simple; you execute USB_InitNoDataControlTransfer().
It looks like pulling data out of a vendor-specific EP0 transfer is done by setting up .pData and .count and executing USB_InitControlWrite() but I can't seem to find a function to let me know when the data has actually been written from the USB EP0 memory to SRAM. The CDC and HID drivers just assume the data will be there soon enough and don't worry about it.
How long does it usually take the USB stack to transfer the data from an EP0 OUT transfer to SRAM? What backround process/interrupts must be running for this to occur?
Anyone? Should I just open a support ticket?