see https://lore.kernel.org/patchwork/patch/764404/ for reference

qemu-fake-rndis.patch

--- a/hw/usb/dev-network.c	2020-05-28 00:00:00.000000000 +0800
+++ b/hw/usb/dev-network.c	2020-05-28 00:00:00.000000000 +0000
@@ -47,8 +47,8 @@
 /* For hardware that can talk RNDIS and either of the above protocols,
  * use this ID ... the windows INF files will know it.
  */
-#define RNDIS_VENDOR_NUM        0x0525  /* NetChip */
-#define RNDIS_PRODUCT_NUM       0xa4a2  /* Ethernet/RNDIS Gadget */
+#define RNDIS_VENDOR_NUM        0x04b3  /* IBM */
+#define RNDIS_PRODUCT_NUM       0x4010  /* Ethernet/RNDIS Gadget */
 
 enum usbstring_idx {
     STRING_MANUFACTURER		= 1,
@@ -66,6 +66,10 @@
 #define DEV_CONFIG_VALUE		1	/* CDC or a subset */
 #define DEV_RNDIS_CONFIG_VALUE		2	/* RNDIS; optional */
 
+#define USB_CLASS_MISC			0xef	/* For rndiscmp.inf compatibility */
+#define USB_MISC_SUBCLASS_RNDIS	0x04
+#define USB_MISC_RNDIS_PROTO_ENET	0x01
+
 #define USB_CDC_SUBCLASS_ACM		0x02
 #define USB_CDC_SUBCLASS_ETHERNET	0x06
 
@@ -188,9 +192,9 @@
         /* CDC Control Interface */
         .bInterfaceNumber              = 0,
         .bNumEndpoints                 = 1,
-        .bInterfaceClass               = USB_CLASS_COMM,
-        .bInterfaceSubClass            = USB_CDC_SUBCLASS_ETHERNET,
-        .bInterfaceProtocol            = USB_CDC_PROTO_NONE,
+        .bInterfaceClass               = USB_CLASS_MISC,
+        .bInterfaceSubClass            = USB_MISC_SUBCLASS_RNDIS,
+        .bInterfaceProtocol            = USB_MISC_RNDIS_PROTO_ENET,
         .iInterface                    = STRING_CONTROL,
         .ndesc                         = 3,
         .descs = (USBDescOther[]) {

note change bMaxBurst?

USB\MS_COMP_RNDIS&MS_SUBCOMP_5162001

https://docs.microsoft.com/en-us/windows-hardware/drivers/network/mb-interface-model-supplement

GET_DESCRIPTOR
String Descriptor Structure
0x12 0x03 4D00530046005400310030003000 0xcd 0x00