A control message is always 40 bytes (32 bytes string data and 8 bytes other data) but the check we have in the current SDK is as below
if (((isCtrlMsg == TRUE) && ((payload->len) <= (CDD_IPC_MAX_CTRL_MSG_LEN))) || ((payload->len) <= (CDD_IPC_MAX_MSG_LEN)))

This is not proper boundary check when isCtrlMsg isTRUE and payload->len is larger than CDD_IPC_MAX_CTRL_MSG_LEN but smaller than CDD_IPC_MAX_MSG_LEN?
the if-statement will let this through but it should be failed ideally.

Ensure Proper boundary checks for messages and end points in CDD IPC

Rootcause : MC/DC missed/not covered for this condition, No justification give for this in Gap report.

Solution : Add MC/DC test cases and get the coverage after above change.