It's possible (at least on F4 MCU's) to have RXNE and STOPF set at the same time during a call to the slave IRQ handler. In such cases RXNE should be handled before STOPF so that all bytes are processed before i2c_slave_process_rx_end() is called.