LPC4088 USB Host HID HardFault when calling USBH_HID_GetKeyboardKey() after keyboard key press

I am facing a HardFault while using the Keil USB Host HID middleware on an LPC4088. The keyboard enumerates successfully, but as soon as a key
is pressed, the system enters a HardFault.

Environment

- MCU: LPC4088
- IDE: Keil MDK v5.43.1
- CMSIS: 5.3.0
- USB Middleware: 6.14.1
- RTOS: CMSIS-RTOS (RTX)
- USB Host: OHCI
- HID Device: Standard USB Keyboard

USB Host Configuration

- Memory Pool Size: 1024 bytes
- Memory Pool Relocated: 0x20002000
- Maximum Pipes: 3

Application

The keyboard is polled from a dedicated RTOS thread. The handler calls
USBH_HID_GetDeviceStatus(0), and if the device status is usbOK, it calls
USBH_HID_GetKeyboardKey(0). No additional processing is performed.

Behaviour

- USB keyboard enumerates successfully.
- USBH_HID_GetDeviceStatus() returns usbOK.
- No HardFault occurs while the keyboard is idle.
- As soon as any key is pressed, the system enters a HardFault.

HardFault Information

R0 = 0x00000000 R1 = 0x00000000 R2 = 0x6F000000  R3 = 0x00000000  R12 =0x00000000  LR = 0x0000985D  PC = 0x00009150

CFSR = 0x00008200 HFSR = 0x40000000 BFAR = 0x6F000008

The BusFault indicates: - PRECISERR - BFARVALID

Faulting Instruction

0x00009150 LDR r4,[r2,#8]

At address 0x0000907A: R2 = 0x20002000

Therefore the middleware reads (uint32_t )(0x20002084). The value stored
there becomes 0x6F000000, which is later dereferenced, causing the
HardFault.

Observations

- Thread stack usage is approximately 64 bytes out of 1024 bytes.
- USB Host memory pool is located at 0x20002000.
- The crash only occurs after the first keyboard report is received.
- Enumeration and device detection work correctly.

Questions

1. Has anyone seen similar behavior with USB Middleware 6.14.1 on
LPC4088?
2. Is a 1024-byte USB Host memory pool sufficient for a standard HID
keyboard, or should it be increased?
3. Are there any known issues related to USBH_HID_GetKeyboardKey() or
the USB Host middleware when used with CMSIS-RTOS?

Any suggestions or debugging advice would be greatly appreciated.

Thank you.