diff --git a/Src/gex_gateway.c b/Src/gex_gateway.c
index c4cff3d..4bb1267 100644
--- a/Src/gex_gateway.c
+++ b/Src/gex_gateway.c
@@ -32,7 +32,7 @@ enum GW_CMD {
     CMD_MSG4SLAVE = 'm', // 109
 };
 
-void respond_gw_id(); // TODO impl
+void respond_gw_id() {} // TODO impl
 
 void start_slave_cmd(uint8_t slave_addr, uint16_t frame_len, uint8_t cksum)
 {
@@ -47,6 +47,7 @@ void gw_process(void)
 {
     static uint8_t buffer[MQ_SLOT_LEN];
     while (mq_read(&usb_rxq, buffer)) { // greedy - handle as many as possible
+        dbg("Handling frame.");
         if (urx_state == URXS_IDLE) {
             PayloadParser pp = pp_start(buffer, MQ_SLOT_LEN, NULL);
 
@@ -55,7 +56,7 @@ void gw_process(void)
             // magic twice, one inverted - denotes a gateway command
             uint16_t magic1 = pp_u8(&pp);
             uint16_t magic2 = pp_u8(&pp);
-            if (magic1 == MAGIC_GW_COMMAND && magic2 == ~MAGIC_GW_COMMAND) {
+            if (magic1 == MAGIC_GW_COMMAND && magic2 == (0xFFU & (~MAGIC_GW_COMMAND))) {
                 // third byte is the command code
                 switch (pp_u8(&pp)) {
                     case CMD_GET_ID:
@@ -67,7 +68,7 @@ void gw_process(void)
                         uint16_t frame_len = pp_u16(&pp);
                         uint8_t cksum = pp_u8(&pp);
 
-                        if (frame_len > MAX_FRAME_LEN) {
+                        if (frame_len == 0 || frame_len > MAX_FRAME_LEN) {
                             dbg("Frame too big!");
                             break;
                         }
@@ -76,10 +77,13 @@ void gw_process(void)
                         dbg("Collecting frame for slave %02x: %d bytes", (int)slave_addr, (int)frame_len);
                         urx_state = URXS_MSG4SLAVE;
                         break;
+
+                    default:
+                        dbg("Bad cmd");
                 }
             } else {
                 // Bad frame??
-                dbg("Bad USB frame, starts %x", buffer[0]);
+                dbg("Bad USB frame, starts %x,%x", buffer[0],buffer[1]);
             }
         }
         else if (urx_state == URXS_MSG4SLAVE) {
diff --git a/Src/main.c b/Src/main.c
index da26f91..135a165 100644
--- a/Src/main.c
+++ b/Src/main.c
@@ -48,6 +48,7 @@
   */
 /* Includes ------------------------------------------------------------------*/
 #include <gex_gateway.h>
+#include <msg_queue.h>
 #include "main.h"
 #include "stm32f1xx_hal.h"
 #include "dma.h"
@@ -122,12 +123,15 @@ int main(void)
   /* USER CODE END 2 */
     dbg("Main loop starts.");
 
+    mq_init(&usb_rxq);
+    mq_init(&usb_txq);
+
   /* Infinite loop */
   /* USER CODE BEGIN WHILE */
     int cnt = 0;
   while (1)
   {
-    if (cnt++ > 10000) {
+    if (cnt++ > 100000) {
       GPIOC->ODR ^= (1 << 13);
       cnt = 0;
     }
diff --git a/Src/usbd_cdc_if.c b/Src/usbd_cdc_if.c
index 5a1bebd..bde0dfa 100644
--- a/Src/usbd_cdc_if.c
+++ b/Src/usbd_cdc_if.c
@@ -49,6 +49,7 @@
 
 /* Includes ------------------------------------------------------------------*/
 #include <debug.h>
+#include <msg_queue.h>
 #include "usbd_cdc_if.h"
 
 /* USER CODE BEGIN INCLUDE */
@@ -295,7 +296,12 @@ static int8_t CDC_Receive_FS(uint8_t* Buf, uint32_t *Len)
   USBD_CDC_SetRxBuffer(&hUsbDeviceFS, &Buf[0]);
   USBD_CDC_ReceivePacket(&hUsbDeviceFS);
 
-  //
+  // queue the frame
+  dbg("USB rx frame");
+  bool suc = mq_post(&usb_rxq, Buf, *Len);
+  if (!suc) {
+    dbg("USB rxq overrun!");
+  }
 
   return (USBD_OK);
   /* USER CODE END 6 */