[scottmogul]

Summary

Fixes end-to-end delivery of P25 confirmed extended-address PDU data (TMS and SNDCP/IP over EXT_ADDR). On r05a06_dev these messages fail two ways: extended-address PDUs fail CRC-32 and get NACK'd, and even once delivered, the sending radio reports send-failed because the delivery ACK relayed back to it is missing the source LLID. Three related changes fix the path end to end.

CRC-32 scope (Assembler.cpp) — the packet-level CRC-32 was computed and checked over the wrong byte range. The correct scope is the entire PDU content stream (second header + payload + padding), everything except its own trailing 4 bytes; the stock code excluded padding from the window. Fixed both disassemble() (RX check) and assemble() (TX generate) so the two sides agree, and removed the now-unnecessary "move CRC after padding" step. For non-extended-address PDUs secondHeaderOffset is 0 and padding handling is unchanged, so ordinary P25 data traffic is unaffected.

Outbound status bits (Data.cpp) — writeRF_PDU() encoded status symbols using m_inbound, which was still set when emitting the ACK/NACK responses, retries, and local repeats generated in reply to an inbound frame. Outbound bursts therefore went out marked inbound. m_inbound is now cleared before those outbound transmissions are generated (top of the RSP branch and before the SAP switch).

ACK source LLID (Data.cpp) — two writeRF_PDU_Ack_Response() call sites in the RF response path passed only 5 arguments, so the source LLID bound to the extendedAddress bool parameter and srcLlId defaulted to 0. The relayed delivery ACK went back to the originator with srcLLId = 0, and the originating radio couldn't match it to its outstanding message — reporting send-failed despite successful delivery. Both call sites now pass the source LLID in its own argument, matching the other call sites in the file.

Component(s)

• dvmhost
• dvmfne
• dvmbridge
• dvmpatch
• dvmcmd
• sysview
• tged
• peered
• Other (explain below)

Type of change

• Bug fix
• Refactor / cleanup
• Performance improvement
• Documentation update
• Build / tooling change

Related issues

N/A

Build & test notes

Built and tested on real hardware against two Motorola XTS2500 subscribers (RIDs 1139554 / 1139555) through a live repeater.

• CRC-32 scope was verified against a real captured extended-address RF frame via a brute-force range search over dvmhost's own CRC-32 implementation; with the fix the decode check passes (packetCRCFailed = 0) and the payload round-trips through assemble().
• Full end-to-end TMS confirmed both directions (A→B and B→A): message delivered, receiver ACK generated and relayed, and the sending radio reports delivered. Before the ACK fix, relayed responses logged srcLLId = 0 and senders reported send-failed; after, responses carry the correct source LLID (srcLLId = 1139555 / 1139554) and delivery succeeds.

Environment

• OS / distro: Raspberry Pi OS (Debian trixie)
• Compiler version: g++ (Debian 14.2.0-19) 14.2.0
• Special build flags: none

Scope of testing: conventional extended-address PDU data (TMS) only. I have not run a broader regression pass and have not tested trunking; the changes are P25 PDU-path only and by inspection shouldn't affect trunking (TSBK/TSDU and grant handling are separate paths), but I haven't confirmed that on-air.

Logs / output

Before (dev), relayed response — source LLID dropped:

OSP, response, rspClass = $00, rspType = $01, rspStatus = $05, llId = 1139555, srcLLId = 0

After (this PR), relayed response — source LLID populated, delivery succeeds:

OSP, response, rspClass = $00, rspType = $01, rspStatus = $00, llId = 1139555, srcLLId = 1139554

Checklist

• Change is scoped and focused
• Existing functionality verified
• No unrelated refactors included
• Documentation updated if needed
• No secrets or credentials included

Notes for maintainers

The three fixes all serve one goal — making confirmed extended-address TMS work end to end — but are independent and could be reviewed separately if preferred. The ACK source-LLID issue is a r05a06_dev regression: the older master call sites passed the source LLID correctly (6 args), and the current dev call sites drop it into the bool parameter (5 args); this restores the correct behavior. DMR and NXDN are untouched. The disassemble() change includes a diagnostic log block that prints received-vs-computed CRC on failure — happy to trim it if you'd rather keep the path lean.