void mca_ccb_cong(tMCA_CCB* p_ccb, tMCA_CCB_EVT* p_data) {
  MCA_TRACE_DEBUG("mca_ccb_cong cong=%d/%d", p_ccb->cong, p_data->llcong);
  p_ccb->cong = p_data->llcong;
 if (!p_ccb->cong) {
 /* if there's a held packet, send it now */
 if (p_ccb->p_tx_req && !p_ccb->p_tx_req->hdr.layer_specific) {
      p_data = (tMCA_CCB_EVT*)p_ccb->p_tx_req;
      p_ccb->p_tx_req = NULL;
      mca_ccb_snd_req(p_ccb, p_data);
 }
 }
}

The product reads data past the end, or before the beginning, of the intended buffer.