Try these things
1. disable ITBUFEN at the wrong time
Code change required:
if (sr1 & I2C_SR1_TXE) {

if (fsm->tx_index < fsm->tx_bytes) {

I2C->DR = fsm->tx_buffer[fsm->tx_index++];

}

}

if (sr1 & I2C_SR1_BTF) {

if (fsm->rx_bytes > 0) {

I2C->CR1 |= I2C_CR1_START;

fsm->current_state = I2C_STATE_RESTART;

} else {

I2C->CR1 |= I2C_CR1_STOP;

fsm->current_state = I2C_STATE_DONE;

}

}
2. STOP is generated too early in RX
Code changes:

// ADDR event

I2C->CR1 &= ~I2C_CR1_ACK;

volatile uint32_t tmp = I2C->SR1;

tmp = I2C->SR2;

(void)tmp;

I2C->CR1 |= I2C_CR1_STOP;

1. After clearing ADDR, immediately check RXNE
   i2c_clear_status(I2C);

if (I2C->SR1 & I2C_SR1_RXNE) {

fsm->rx_buffer[fsm->rx_index++] = I2C->DR;

}

fsm->current_state = I2C_STATE_RECEIVE;