plugin_hf_capture_sio() passed a fixed 32 bytes to append_picopass_sio()
no matter how long the response was. A short or truncated READ4 fed the
SIO whatever else happened to be sitting in the receive buffer past the
end of the frame.
Derive the length from the frame instead, trimming the trailing CRC and
clamping to the four blocks a READ4 can return. The DESFire branch got
the same treatment: its length was computed as size - 2 with no check
that the response held at least two bytes, so an empty frame underflowed
to a huge value. Both now bail out when the response is too short to
hold a trailer.
Claude-Session: https://claude.ai/code/session_016a4SuDfC8EkHo3MGGrRMod
Eric Betts