How could I detect rogue pointer in DSP?

This can be difficult to find in any system, but it is a bit harder in a system that is running with both ARM and DSP because so much is going on. In general you would probably be best looking for a rogue pointer with CCS, you can use CCS with a Codec Engine based application by following the steps in this wiki article, though if you have a stand alone DSP executable for testing that will likely be easier.

Once you have CCS you could do traditional debugging, stepping through the code and checking pointer values for validity or assuming this rogue pointer ends up crashing the DSP application or at least generating incorrect data stepping through to that point to look for bad pointers. With most of the Davinci parts (DM644x, DM646x) this is what you are really limited to, as they do not support Advanced Event Triggering.

If your device supports Advanced Event Triggering than finding a rogue pointer becomes a bit easier, since you can set up a trigger to halt the processor when it detects a data access to particular regions (essentially you can breakpoint when it accesses the region in ARM Linux memory space).

Thank you

But I checked AET doc, Only Full-GEM devices have AET/Trace capabilities. The Mid-GEM devices do not. 

Our device is Mid-GEM, we can't use AET    :(

You might find the culprit listed among the issues in this article:

http://wiki.davincidsp.com/index.php?title=DSP_BIOS_Debugging_Tips