In the event that RPMessage_recv() has a a timeout the recv_buffer is not cleaned up and can lead to a corruption:

"In case of no incoming message already available at the call time, RPMessage_recv() saves the data pointer passed to it, for use in incoming message handler, and then sleeps.

This sleep can be terminated by timeout or other error condition. In this case, the saved pointer was left. Later, on arrive of incoming message, that message was copied to the memory pointed by that pointer, causing overwrite of whatever is in that memory, and unpredictable consequences."