Should be pointing to the CRC location in the *unescaped* packet
buffer since the CRC is subject to escaping/unescaping. Previous
code pointed to the wrong location in the escaped packet buffer,
which was often pointing to the write place if there weren't many
escaped bytes in the input buffer, but was still wrong.
Aleksander Morgado
Dan Williams