static int esp32_ipm_send(const struct device *dev, int wait, uint32_t id,
             const void *data, int size)
{
...

    if (dev_data->shm_size < size) { // negative size pass this check
        LOG_ERR("Not enough memory in IPM channel");
        return -ENOMEM;
    }

...

    /* data copied, set the id and, generate interrupt in the remote core */
    if (dev_data->this_core_id == 0) {
        memcpy(dev_data->shm.app_cpu_shm, data, size); // BOF!!!
        atomic_set(&dev_data->control->lock, ESP32_IPM_LOCK_FREE_VAL);
        LOG_DBG("Generating interrupt on remote CPU 1 from CPU 0");
#if defined(CONFIG_SOC_SERIES_ESP32) || defined(CONFIG_SOC_SERIES_ESP32_NET)
        DPORT_WRITE_PERI_REG(DPORT_CPU_INTR_FROM_CPU_1_REG, DPORT_CPU_INTR_FROM_CPU_1);
#elif defined(CONFIG_SOC_SERIES_ESP32S3)
        WRITE_PERI_REG(SYSTEM_CPU_INTR_FROM_CPU_1_REG, SYSTEM_CPU_INTR_FROM_CPU_1);
#endif

    } else {
        memcpy(dev_data->shm.pro_cpu_shm, data, size); // BOF!!!