Thanks TP, so it seems to be external controllers that are vulnerable to this.
It is not just the SS or ESS, my CSMIO/IP-A did it today and I see in the post Sam linked to that it also did it way back then.
So looks like it is not an easy fix and is likely Mach itself sending bad info to the plugins.
Hood