This could be considered both a documentation issue and a programming deficiency. I've got a composite CDC + MSD device that was failing because the endpoint callback array wasn't large enough. The configuration macro USB_DEVICE_CONFIG_ENDPOINTS sets the number of endpoints supported, but what's not mentioned directly in the docs is that it also determines the maximum endpoint number. In this case there were 5 endpoints configured with the highest being numbered 5.
The USB_DeviceInitEndpoint() function does check for this condition at runtime, and returns an error. The documentation is not right (emphasis mine):
kStatus_USB_Invalid-Parameter: The epInit or epCallback is NULL pointer. Or the endpoint number is more
...but the code is, and it returns an error if the endpoint number is not less than the configured maximum. The coding issue is in usb_device_cdc_acm.c: USB_DeviceCdcAcmEndpointsInit() takes the error code but doesn't check it, doesn't stop processing endpoints, and then overwrites the error code when it moves on to the interface initialization.
Not a biggie, but if anyone's taking bug reports, there you go.