void smp_br_process_security_grant(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
 uint8_t res = *(uint8_t*)p_data;
  SMP_TRACE_DEBUG("%s", __func__);
 if (res != SMP_SUCCESS) {
    smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, p_data);
 } else {
 /* otherwise, start pairing; send IO request callback */
    p_cb->cb_evt = SMP_BR_KEYS_REQ_EVT;
 }
}

The product reads data past the end, or before the beginning, of the intended buffer.