diff --git a/board/main.c b/board/main.c
index 0f63708..c0ac506 100644
--- a/board/main.c
+++ b/board/main.c
@@ -20,7 +20,6 @@ int safety_tx_lin_hook(int lin_num, uint8_t *data, int len, int hardwired);
 #include "honda_safety.h"
 #endif
 
-// debug safety check: is controls allowed?
 int started = 0;
 
 // optional features
@@ -129,11 +128,11 @@ void set_fan_speed(int fan_speed) {
   TIM3->CCR3 = fan_speed;
 }
 
-void usb_cb_ep0_out(uint8_t *usbdata, int len, int hardwired) {
-  if (setup.b.bRequest == 0xde) {
+void usb_cb_ep0_out(USB_Setup_TypeDef *setup, uint8_t *usbdata, int hardwired) {
+  if (setup->b.bRequest == 0xde) {
     puts("Setting baud rate from usb\n");
     uint32_t bitrate = *(int*)usbdata;
-    uint16_t canb_id = setup.b.wValue.w;
+    uint16_t canb_id = setup->b.wValue.w;
 
     if (can_ports[canb_id].gmlan)
       can_ports[canb_id].gmlan_bitrate = bitrate;
@@ -438,7 +437,9 @@ int spi_buf_count = 0;
 int spi_total_count = 0;
 uint8_t spi_tx_buf[0x44];
 
+//TODO Jessy: Audit for overflows
 void handle_spi(uint8_t *data, int len) {
+  USB_Setup_TypeDef *fake_setup;
   memset(spi_tx_buf, 0xaa, 0x44);
   // data[0]  = endpoint
   // data[2]  = length
@@ -448,7 +449,11 @@ void handle_spi(uint8_t *data, int len) {
   switch (data[0]) {
     case 0:
       // control transfer
-      *resp_len = usb_cb_control_msg((USB_Setup_TypeDef *)(data+4), spi_tx_buf+4, 0);
+      fake_setup = (USB_Setup_TypeDef *)(data+4);
+      *resp_len = usb_cb_control_msg(fake_setup, spi_tx_buf+4, 0);
+      // Handle CTRL writes with data
+      if (*resp_len == 0 && (fake_setup->b.bmRequestType & 0x80) == 0 && fake_setup->b.wLength.w)
+        usb_cb_ep0_out(fake_setup, data+4+sizeof(USB_Setup_TypeDef), 0);
       break;
     case 1:
       // ep 1, read
diff --git a/board/usb.h b/board/usb.h
index a422883..796e89d 100644
--- a/board/usb.h
+++ b/board/usb.h
@@ -82,7 +82,7 @@ USB_Setup_TypeDef;
 // interfaces
 void usb_cb_enumeration_complete();
 int  usb_cb_control_msg(USB_Setup_TypeDef *setup, uint8_t *usbdata, int hardwired);
-void usb_cb_ep0_out(uint8_t *usbdata, int len, int hardwired);
+void usb_cb_ep0_out(USB_Setup_TypeDef *setup, uint8_t *usbdata, int hardwired);
 int  usb_cb_ep1_in(uint8_t *usbdata, int len, int hardwired);
 void usb_cb_ep2_out(uint8_t *usbdata, int len, int hardwired);
 void usb_cb_ep3_out(uint8_t *usbdata, int len, int hardwired);
@@ -581,7 +581,7 @@ void usb_irqhandler(void) {
       #endif
 
       if(endpoint == 0){
-        usb_cb_ep0_out(usbdata, len, 1);
+        usb_cb_ep0_out(&setup, usbdata, 1);
       }
 
       if (endpoint == 2) {
diff --git a/panda/__init__.py b/panda/__init__.py
index aa6aca1..274140d 100644
--- a/panda/__init__.py
+++ b/panda/__init__.py
@@ -57,8 +57,11 @@ class WifiHandle(object):
     return ret[4:4+length]
 
   def controlWrite(self, request_type, request, value, index, data, timeout=0):
-    # ignore data in reply, panda doesn't use it
-    return self.controlRead(request_type, request, value, index, 0, timeout)
+    self.sock.send(
+      struct.pack("HHBBHHH", 0, 0, request_type, request, value, index, len(data)) + data
+    )
+    retdata = self.__recv()
+    assert len(retdata) == 0
 
   def controlRead(self, request_type, request, value, index, length, timeout=0):
     self.sock.send(struct.pack("HHBBHHH", 0, 0, request_type, request, value, index, length))
diff --git a/tests/loopback_test.py b/tests/loopback_test.py
index 4d1d3f9..475c56e 100755
--- a/tests/loopback_test.py
+++ b/tests/loopback_test.py
@@ -35,11 +35,6 @@ def run_test_w_pandas(pandas, can_speeds, gmlan_speeds, sleep_duration=0):
   for hh in h:
     hh.set_controls_allowed(True)
 
-  # Currently can not set can/gmlan baud over wifi.
-  set_speed = not any((p._serial == "WIFI" for p in h))
-  if not set_speed:
-    print("*** Can not set speed on wifi pandas ***")
-
   # test both directions
   for ho in permutations(range(len(h)), r=2):
     print("***************** TESTING", ho)
@@ -86,15 +81,14 @@ def run_test_w_pandas(pandas, can_speeds, gmlan_speeds, sleep_duration=0):
         panda_snd.set_gmlan(bus, gmlan)
         panda_rcv.set_gmlan(bus, gmlan)
 
-      if set_speed:
-        if gmlan:
-          print("Setting GMLAN %d Speed to %d" % (bus, gmlan_speeds[bus]))
-          panda_snd.set_can_baud(bus, gmlan_speeds[bus])
-          panda_rcv.set_can_baud(bus, gmlan_speeds[bus])
-        else:
-          print("Setting CanBus %d Speed to %d" % (bus, can_speeds[bus]))
-          panda_snd.set_can_baud(bus, can_speeds[bus])
-          panda_rcv.set_can_baud(bus, can_speeds[bus])
+      if gmlan:
+        print("Setting GMLAN %d Speed to %d" % (bus, gmlan_speeds[bus]))
+        panda_snd.set_can_baud(bus, gmlan_speeds[bus])
+        panda_rcv.set_can_baud(bus, gmlan_speeds[bus])
+      else:
+        print("Setting CanBus %d Speed to %d" % (bus, can_speeds[bus]))
+        panda_snd.set_can_baud(bus, can_speeds[bus])
+        panda_rcv.set_can_baud(bus, can_speeds[bus])
 
       # send the characters
       # pick addresses high enough to not conflict with honda code