This could be considered both a documentation issue and a programming deficiency. I've got a composite CDC + MSD device that was failing because the endpoint callback array wasn't large enough. The configuration macro USB_DEVICE_CONFIG_ENDPOINTS sets the number of endpoints supported, but what's not mentioned directly in the docs is that it also determines the maximum endpoint number. In this case there were 5 endpoints configured with the highest being numbered 5.
The USB_DeviceInitEndpoint() function does check for this condition at runtime, and returns an error. The documentation is not right (emphasis mine):
kStatus_USB_Invalid-Parameter: The epInit or epCallback is NULL pointer. Or the endpoint number is more
than USB_DEVICE_CONFIG_ENDPOINTS
...but the code is, and it returns an error if the endpoint number is not less than the configured maximum. The coding issue is in usb_device_cdc_acm.c: USB_DeviceCdcAcmEndpointsInit() takes the error code but doesn't check it, doesn't stop processing endpoints, and then overwrites the error code when it moves on to the interface initialization.
Not a biggie, but if anyone's taking bug reports, there you go.
Regards,
Scott