STM32 CAN simulation problem

Use source:

#include "stm32f10x.h"

void USB_HP_CAN1_TX_IRQHandler() {
        if(CAN1->TSR & CAN_TSR_RQCP0)
                CAN1->TSR |= CAN_TSR_RQCP0;
        if(CAN1->TSR & CAN_TSR_RQCP1)
                CAN1->TSR |= CAN_TSR_RQCP1;
        if(CAN1->TSR & CAN_TSR_RQCP2)
                CAN1->TSR |= CAN_TSR_RQCP2;
}

int main(){
        RCC->APB2ENR |= RCC_APB2ENR_IOPAEN;
        RCC->APB1ENR |= RCC_APB1ENR_CAN1EN;
        // PA11 - RX floating   // PA12 - TX alt push-pull
        GPIOA->CRH = 0x444B4444;
        CAN1->MCR = CAN_MCR_INRQ;
        while((CAN1->MSR & CAN_MSR_INAK) == 0);
        CAN1->IER = CAN_IER_TMEIE;
        CAN1->BTR = 0x12d000f;
        NVIC_SetPriority(USB_HP_CAN1_TX_IRQn, 0);
        NVIC_EnableIRQ(USB_HP_CAN1_TX_IRQn);
        CAN1->MCR = CAN_MCR_NART;
        while((CAN1->MSR & CAN_MSR_INAK) != 0);
        while(1){
                volatile unsigned int u = 1000000;
                while(u--);
                CAN1->sTxMailBox[0].TDTR = 4;
                CAN1->sTxMailBox[0].TDLR = 1;
                CAN1->sTxMailBox[0].TIR = 1 << 3 | 1 << 2 | 1;
                CAN1->sTxMailBox[1].TDTR = 4;
                CAN1->sTxMailBox[1].TDLR = 1;
                CAN1->sTxMailBox[1].TIR = 2 << 3 | 1 << 2 | 1;
                CAN1->sTxMailBox[2].TDTR = 4;
                CAN1->sTxMailBox[2].TDLR = 1;
                CAN1->sTxMailBox[2].TIR = 3 << 3 | 1 << 2 | 1;
        }
}

When simulation, only messageBox[0] reset TXRQ bit, end set RQCP0, messageBox[1] and messageBox[2] have TXRQ = 1 and RQCP = 0.
If we erase code

  CAN1->sTxMailBox[0].TDTR = 4;
  CAN1->sTxMailBox[0].TDLR = 1;
  CAN1->sTxMailBox[0].TIR = 1 << 3 | 1 << 2 | 1;

then interrupt generated and RQCP0 is set, messageBox[0].TIR copied from messageBox[1].TIR, TXRQ1 = 1.
It's problem in my bxCan understanding or Simulator bug? Keil version 4.70.