What polyfuses protect USB ports in a typical modern PC?

Sorry, but all answers are incorrect. Vast majority of PC mainboards do use polyfuses (aka resettable fuses) to protect USB ports from overcurrent and prevent damage from melting wires and connector's pins. Below are two examples, for ASUS Z170-A mainboard And for ASUS P9X79LE

USB specifications define that "high-powered hosts" must supply AT LEAST 500 mA for USB2, and 900 mA for USB3 ports (and more for Type-C). At least. General rule of design is consumer safety and to reduce OEM liability for setting fires, so the designers tend to limit the available current. High-side switches are expensive, and require even more expensive wire and extra pin on CPU or EC (or whatever). So simple polyfuses do their job quite economically.

Also, 95% (or (99?) of all usb hubs do use polyfuses as well.

As you rightfully found, maindoard use polyfuses at about double the minimum, some can supply up to the level of entire +5VSTBy limit (2.5 A and above).

If someone still has a concern about newer mainboards, here is a snippet of Gigabyte X570 AORUS MASTER (released sometime in 2019), with polyfuses circled:

Not all computers necessarily use a polyfuse to provide overcurrent protection for USB. They may be using a dedicated IC known generally as a USB power switch.

If you know the specific USB power switch used, you can look up the datasheet and find the typical trip current. Finding this is tricky, as you'll need the schematic which is typically proprietary and unpublished. Otherwise, you can look at the PCB and figure out what power switch is used.

To give a specific example, I searched for a ThinkPad X220 schematic and found an alleged copy on a forum. From there, I found that the power switch used is the TI TPS2069. If you take a look at the electrical characteristics in the linked datasheet, you will find that the typical overcurrent trip threshold is 2.85A, with a minimum of 2.3A and a maximum of 3.4A.

No modern PC would use a polyfuse. They use a high-side switch with built-in current limiting. The limiter serves three functions: power domain control, overcurrent protection, and signalling the host when the overcurrent condition occurs (OC trip.) A polyfuse can only do one of those things, and not very accurately or cost-effectively.

The PC port must deliver at least what is required by version of the USB spec it claims to support. For USB2 and earlier, this was 500mA. For USB3.0 this is at least 900mA, and can be up to 2.1A for a battery charging port.

USB3 Type C introduces a more sophisticated approach with options for higher voltage.

The takeaway is, no polyfuse in a PC. And even for non-PC applications, based on my direct experience (set-top boxes) USB power switches are very, very cheap (cheaper than a polyfuse) and more predictable.

I would like to know what is the typical rating of a polyfuse used on modern PCs (desktop or laptop) with USB 2.0 and 3.0.

My main motivation for asking this question is to know whether plugging a faulty device into an older USB port can ever result in that device drawing a much larger current (but not short-circuit) than the USB specifications provide for, and how much more (before the polyfuse trips)

These are conflicting requirements. 'Typical' ratings tell you nothing about the maximum possible. Even having information on a specific laptop model doesn't tell you, because you don't know that the manufacturer didn't change the circuit at some time (which is very common).

If you are designing a product then you surely don't want to limit its use to particular computer models and productions runs, and you don't even know that the user won't plug your device into something else with a USB port. So you should not assume that the host will provide any protection. One thing is for sure though. If the USB port is protected by a polyfuse (which I know some are) then the maximum possible current must be a lot higher than the hold current, which should be similarly higher than the USB port's rating.

If you need actual numbers then I suggest testing as many computers (and other host devices) as you can, using a USB load tester. Alternatively you could start an online survey, or look for existing surveys asking people to report the maximum current their USB ports can provide. This will provide more accurate data than polyfuse specs, since the actual trip current and time is dependent on its thermal characteristics when installed in the device.

There are no fuses in the general USB 3.0 controller (unless you count an electronic fuse circuit as a fuse). The fusing is provided by a mosfet that is built into an IC (host controller or external mosfet) with a current level detection circuit. If the current goes beyond the spec, then the circuit is shut down. With USB 2.0 and earlier the current limit is provided by the host controller and that limit is 500mA.

Source: https://www.usb.org/sites/default/files/usb_20_20190524.zip (USB 2.0 ECN VBUS Max Limit.pdf)

A device cannot sink more current than is sourced, and it is my understanding (based on observation of shorted USB ports that I have shorted) that all ports have some kind of over current detection (and will flag the port in the OS when the current is overdrawn and shut down power to the port) .

Here is a good question on the current outputs of each spec: https://superuser.com/questions/1131515/usb-c-to-usb-a-cable-usb-3-0-with-high-current-at-2m-length If the manufacturer does not report which port belongs to each spec, then there isn't a good way to find out unless the circuit is reverse engineered. Many manufacturers produce USB ports that are out of spec.