in CDD IPC, dstAddr is put into the VRING as part of the message by RPMessage_send and there is no reason that prevents that value from being above 255.
If msg->dstAddr is, lets say, 1000. RPMessage_lookupEndpt will index out of the array returning a pointer to some other memory.
obj will be pointing to this memory and is will be interpreted as a RPMessage struct. Later in RPMessage_enqueMsg data will be copied to a random location in memory .

when the interrupt triggers RPMessage_swiFxn API it calls RPMessage_enqueMsg API, Inside this at the very beginning if we get >256 we are just going and looking in the poo[>256] which can crash the R5F core.