According to ISO11898-1:2015 REC shall be decremented by 1 upon succesfull reception of frame. This means up to succesfull transmission of ACK bit! This point in CAN frame is different than Frame validation which is one bit before end of EOF! This means that Frame can be "succesfully received", REC decremented (after ACK) and e.g. form error occuring in first bit of EOF causing the frame not to be validated (no valid reception will be signaled, no frame will be stored in RX Buffer)!

In CTU CAN FD, the moment of REC decrement is the same as the moment of frame validation and that is last bit of EOF. 7.6.7 of ISO16845-1 2016 is specifically designed to catch this issue as it expects first decrement of REC after ACK and then increment by 1 due to form error on ACK delimiter, thus leaving REC unchanged after the frame is over!

In current implementation of CTU CAN FD the point of decrement will never occur, and REC will only be incremented. This is a bug.