USB devices cannot directly address host memory like PCIe or FireWire, but the XHCI controller does DMA to/from host memory, and most USB device controllers have some kind of DMA between USB and the device's RAM.

All transfers are initiated by the host, including ones that look like they're client-first; there is no DMA, which would be a massive security pain.