Hi, Benton,
Regarding the CAN message buffer, pls refer to the section as following Fig in UM11424.pdf, there are TWO message buffer type, one is FIFO, another is buffer, for simplicity, pls refer to the buffer.
Firstly, you can put the CAN message RAM in any internal RAM location, the CAN->MRBA register defines the start address of the CAN message RAM.
For example the TX buffer, the CAN->TXBC specifies the TX buffer start address(not absolute address, just offset based on CAN->MBRA) and the buffer number. The CAN->TXESC register specifies the data length for each TX buffer.

Hope it can help you
BR
XiangJun Rong