SPI using STM32's DMA sends one word too much
Discovered the issue: The SPI's CRC unit has been enabled by accident, so the excess transfer stems from the CRC checksum. This was impossible to deduct from the above source; enabling CRC happened somewhere else and I missed it.