I have noticed that macros for control transfers defined in usbd_macro.h follow the same (buggy) pattern when specifying the devreq.requesttype.
In the macro there is for example : USB_DIR_IN & USB_RECIP_INTERFACE, so the reult is 0 (USB_DIR_IN = 0x80 & USB_RECIP_INTERFACE = 2). The correct definition should be USB_DIR_IN + USB_RECIP_INTERFACE that gives the (correct) value 0x82 (defined in usb11.pdf, Table 9-3, page 186).
Yes, I agree the macros are wrong. Instead of using + I've changed the macros to use | which I think is more correct for the situation. I've committed the change to CVS.