static void esp_do_dma(ESPState *s)
{
    uint32_t len;
    int to_device;

     len = s->dma_left;
     if (s->do_cmd) {
         trace_esp_do_dma(s->cmdlen, len);
         s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
         return;
     }
        return;
    }

The product writes data past the end, or before the beginning, of the intended buffer.