Configuring SPI for 24 bit data frames and receiving single data frames via HAL_SPI_Receive_IT (which redirects to HAL_SPI_TransmitReceive_IT() in case bidirectional transfer is enabled), hspi->RxXferCount and hspi->RxXferSize are both set to the value transmitted by the Size
parameter. From the APIdocs it is not clear, if this Size parameter means the number of bytes of the pData buffer (as in many other cases) or the number of data frames this buffer can hold. Setting the Size-paramter to 3 in case of 24bit data frames and providing a 4 byte buffer via pData makes HAL_SPI_IRQHandler() overwrite RAM areas outside the buffer because it is iterating across hspi->RxXferCount times 32 bits and overwriting them in line 2827 of stm32h7xx_hal_spi.c.
