If a transfer errors out then actual_length is negative. The only error that is not caught is a timeout error, which should also result in the SSM to move to the next state.
