The same exploit is present in the 8940, but the path to get there is slightly different and incompatible with normal PC host USB controllers due to the need to

The same exploit is present in the 8940, but the path to get there is slightly different and incompatible with normal PC host USB controllers due to the need to avoid ever sending a zero length packet. There are plenty of ports using low level host hardware, for example https://github.com/a1exdandy/checkm8-a5 https://github.com/a1exdandy/checkm8-a5 . I think Sliver does what you want (PIN bypass) end to end for this device.