diff --git a/repos/libports/ports/qemu-usb.hash b/repos/libports/ports/qemu-usb.hash
index 4a175f28ae..d454b358b9 100644
--- a/repos/libports/ports/qemu-usb.hash
+++ b/repos/libports/ports/qemu-usb.hash
@@ -1 +1 @@
-a716b3ed197d29cb3f059a76de9bb4e0e8c708f0
+8b0fa7bf30ac8ee32c547b0eb5f468b947f12ae6
diff --git a/repos/libports/ports/qemu-usb.port b/repos/libports/ports/qemu-usb.port
index 6d6ad34e35..fcd6df94cf 100644
--- a/repos/libports/ports/qemu-usb.port
+++ b/repos/libports/ports/qemu-usb.port
@@ -12,6 +12,7 @@ HASH_INPUT    += $(REP_DIR)/src/lib/qemu-usb/files.list
 PATCHES  := src/lib/qemu-usb/patches/xhci_pci_register.patch \
             src/lib/qemu-usb/patches/usb_bus_nfree.patch \
             src/lib/qemu-usb/patches/hcd-xhci-bei.patch \
+            src/lib/qemu-usb/patches/hcd-xhci-numports.patch \
             src/lib/qemu-usb/patches/xhci_frame_wrap.patch
 
 PATCH_OPT:= -p1
diff --git a/repos/libports/src/lib/qemu-usb/patches/hcd-xhci-numports.patch b/repos/libports/src/lib/qemu-usb/patches/hcd-xhci-numports.patch
new file mode 100644
index 0000000000..fec276da2b
--- /dev/null
+++ b/repos/libports/src/lib/qemu-usb/patches/hcd-xhci-numports.patch
@@ -0,0 +1,13 @@
+--- a/src/lib/qemu/hw/usb/hcd-xhci.c
++++ b/src/lib/qemu/hw/usb/hcd-xhci.c
+@@ -3577,8 +3594,8 @@
+ static Property xhci_properties[] = {
+     DEFINE_PROP_BIT("streams", XHCIState, flags,
+                     XHCI_FLAG_ENABLE_STREAMS, true),
+-    DEFINE_PROP_UINT32("p2",    XHCIState, numports_2, 4),
+-    DEFINE_PROP_UINT32("p3",    XHCIState, numports_3, 4),
++    DEFINE_PROP_UINT32("p2",    XHCIState, numports_2, 8),
++    DEFINE_PROP_UINT32("p3",    XHCIState, numports_3, 8),
+     DEFINE_PROP_LINK("host",    XHCIState, hostOpaque, TYPE_DEVICE,
+                      DeviceState *),
+     DEFINE_PROP_END_OF_LIST(),
diff --git a/repos/libports/src/lib/qemu-usb/qemu_emul.cc b/repos/libports/src/lib/qemu-usb/qemu_emul.cc
index 21538e788b..e8ed3b7fae 100644
--- a/repos/libports/src/lib/qemu-usb/qemu_emul.cc
+++ b/repos/libports/src/lib/qemu-usb/qemu_emul.cc
@@ -40,10 +40,16 @@ static bool const verbose_mmio = false;
 namespace {
 
 /* keep in sync with hcd-xhci.c */
+#define MAX_NUMPORTS    (2 * 8)
 #define OFF_OPER        0x40
 #define OFF_RUNTIME     0x1000
 #define OFF_PORTS       (OFF_OPER + 0x400)
 
+constexpr unsigned max_numports()
+{
+	return MAX_NUMPORTS;
+}
+
 bool port_access(Genode::off_t offset)
 {
 	bool const v = (offset >= OFF_PORTS) && (offset < OFF_RUNTIME);
@@ -56,6 +62,7 @@ uint32_t port_index(Genode::off_t offset)
 	return (offset - OFF_PORTS) / 0x10;
 }
 
+#undef MAX_NUMPORTS
 #undef OFF_OPER
 #undef OFF_RUNTIME
 #undef OFF_PORTS
@@ -279,7 +286,7 @@ struct Object_pool
 		USB_HOST_DEVICE, /* USB host device driver */
 		USB_WEBCAM,      /* USB webcam device driver */
 		USB_FIRST_FREE,  /* first free device */
-		MAX = 14         /* host devices (USB_FIRST_FREE to MAX) */
+		MAX = USB_FIRST_FREE + max_numports() /* host devices (USB_FIRST_FREE to MAX) */
 	};
 
 	bool used[MAX];
@@ -620,7 +627,7 @@ struct Controller : public Qemu::Controller
 		Genode::off_t  offset;
 
 		MemoryRegionOps const *ops;
-	} mmio_regions [16];
+	} mmio_regions [max_numports() + 4 /* number of HC MMIO regions */];
 
 	uint64_t _mmio_size;