An off-by-one that lands the frame CRC byte on a capacity field, stretching the dump command until it spills the canary and a PIE pointer
