Update
The official documentation I linked earlier is outdated. The policy is no longer saved at /etc/qubes-rpc/policy/qubes.InputKeyboard. As per this discussion, it’s now stored at /etc/qubes/policy.d/50-config-input.policy
It ultimately made no difference, as this policy already enabled USB passthrough to dom0:
qubes.InputKeyboard * sys-usb dom0 allow
Likewise, the boot parameters at /etc/default/grub do not contain rd.qubes.hide_all_usb at all. It does contain the usbcore.authorized_default=0 flag introduced in 4.1, but I’m under the impression this should still work in 4.2.4 & should not interfere with my device
My new working theory is some kind of USB controller mismatch. I plan to down three beers and take another crack at it