rem: for (i = 0; i < src->len; i++)
add: len += decode_unsigned16(&npdu[len], &src->net);   src->len = npdu[len++]; if (src->len)
context: int npdu_decode(  uint8_t *npdu,  BACNET_ADDRESS *dest,  BACNET_ADDRESS *src,  BACNET_NPDU_DATA *npdu_data){  int len = 0; // return value - number of octets loaded in this function  int i = 0; // counter   if (npdu && npdu_data)  {    // Protocol Version    npdu_data->protocol_version = npdu[0];    // control octet    // Bit 7: 1 indicates that the NSDU conveys a network layer message.    //          Message Type field is present.    //        0 indicates that the NSDU contains a BACnet APDU.    //          Message Type field is absent.    npdu_data->network_layer_message = (npdu[1] & BIT7) ? true : false;    //Bit 6: Reserved. Shall be zero.    // Bit 4: Reserved. Shall be zero.    // Bit 2: The value of this bit corresponds to the data_expecting_reply    // parameter in the N-UNITDATA primitives.    // 1 indicates that a BACnet-Confirmed-Request-PDU,    // a segment of a BACnet-ComplexACK-PDU,    // or a network layer message expecting a reply is present.    // 0 indicates that other than a BACnet-Confirmed-Request-PDU,    // a segment of a BACnet-ComplexACK-PDU,    // or a network layer message expecting a reply is present.    npdu_data->data_expecting_reply = (npdu[1] & BIT2) ? true : false;    // Bits 1,0: Network priority where:    // B'11' = Life Safety message    // B'10' = Critical Equipment message    // B'01' = Urgent message    // B'00' = Normal message    npdu_data->priority = npdu[1] & 0x03;    // set the offset to where the optional stuff starts    len = 2;    //Bit 5: Destination specifier where:    // 0 = DNET, DLEN, DADR, and Hop Count absent    // 1 = DNET, DLEN, and Hop Count present    // DLEN = 0 denotes broadcast MAC DADR and DADR field is absent    // DLEN > 0 specifies length of DADR field    if (dest && (npdu[1] & BIT5))    {      len += decode_unsigned16(&npdu[len], &dest->net);      // DLEN = 0 denotes broadcast MAC DADR and DADR field is absent      // DLEN > 0 specifies length of DADR field      dest->len = npdu[len++];      if (dest->len)      {        for (i = 0; i < dest->len; i++)        {          dest->adr[i] = npdu[len++];        }      }    }    // Bit 3: Source specifier where:    // 0 =  SNET, SLEN, and SADR absent    // 1 =  SNET, SLEN, and SADR present    // SLEN = 0 Invalid    // SLEN > 0 specifies length of SADR field    if (src && (npdu[1] & BIT3))    {      len += decode_unsigned16(&npdu[len], &src->net);      // SLEN = 0 denotes broadcast MAC SADR and SADR field is absent      // SLEN > 0 specifies length of SADR field      src->len = npdu[len++];      if (src->len)      {        for (i = 0; i < src->len; i++)        {          src->adr[i] = npdu[len++];        }      }    }    // The Hop Count field shall be present only if the message is    // destined for a remote network, i.e., if DNET is present.    // This is a one-octet field that is initialized to a value of 0xff.    if (dest && dest->net)      npdu_data->hop_count = npdu[len++];    // Indicates that the NSDU conveys a network layer message.    // Message Type field is present.    if (npdu_data->network_layer_message)    {      npdu_data->network_message_type = npdu[len++];      // Message Type field contains a value in the range 0x80 - 0xFF,      // then a Vendor ID field shall be present      if (npdu_data->network_message_type >= 0x80)        len += decode_unsigned16(&npdu[len], &npdu_data->vendor_id);    }  }  return len;}