diff --git a/drivers/usb/xhcid/src/xhci/mod.rs b/drivers/usb/xhcid/src/xhci/mod.rs
index 8dd967932e..aaf0bb31d6 100644
--- a/drivers/usb/xhcid/src/xhci/mod.rs
+++ b/drivers/usb/xhcid/src/xhci/mod.rs
@@ -307,6 +307,15 @@ pub struct Xhci<const N: usize> {
     device_enumerator_receiver: Receiver<DeviceEnumerationRequest>,
 }
 
+}
+// SAFETY: Xhci<N> contains the following fields with their safety mechanisms:
+// - `port_states`, `handles`, `drivers`: CHashMap (per-key interior locking)
+// - `op`, `ports`, `cmd`, `run`, `primary_event_ring`: Mutex<...>
+// - `irq_reactor_*_sender`: crossbeam_channel (lock-free MPMC)
+// - `dev_ctx`, `scratchpad_buf_arr`: Dma<...> (internal mutex)
+// - `dbs`: Arc<Mutex<...>>
+// All shared mutable state is protected by interior mutability primitives.
+// Xhci<N> does not contain !Send/!Sync fields (File is Send+Sync, Dma is Send+Sync).
 unsafe impl<const N: usize> Send for Xhci<N> {}
 unsafe impl<const N: usize> Sync for Xhci<N> {}