In section 3.8.7.10, the code snippet for the copy routine specifies
// a0 is dst pointer
// a1 is src pointer
// a2 is len
However, in operation, the code copies from destination to source, which is counterintuitive given the parameter names. The comments say a0 is dst and a1 is src, but the code copies from a0 to a1. So effectively, it copies from dst to src, which is probably unintended.