Solved
One thing CubeMX developers can do to help is to add some comments
to CDC_Receive_FS to say it is a callback function and that you should copy
out the data presented in Buf (of length Len) to your own buffer before it gets
lost with next data arriving through USB. Also hint Len is maximum APP_RX_DATA_SIZE.
(Aside - the code in previous post seems to have had the hash in hash defines replaced by numbers 😑
Thats just the interpreting the hash as numbered indented points - ignore it and use hash symbols for hash defines)