JP1 Remotes

Having had a look thorough the code for for these in the 9960 & other extenders, they are all similar in terms of the way that they handle the hex commands eg. (from 9960 extender):
Protocol_1F9:
db 00,00,01
org Ram
LD R4A, R03 ;Get the "HEX command" from the KeyMove
SWAP R4A ;Timeout value in high nibble
AND R4A, 0F ;Set timeout
CALL StartT0

AND R03, 07 ;Length of SHORT/SINGLE press side
LD W3, R3A ;Body length of keymove
SUB RC3, 3 ;keylist length

TM R2D, 08 ;Check for a Double Key Press requested?
JRNZ L1F9_7

; Check for Long Key Press
L1F9_1: CALL ScanKeypad
JRNC L1F9_5 ;Key is no longer pressed
L1F9_2: TM R_IFlags, 20 ;Test timeout
JRZ L1F9_1
JR L1F9_3

; Check for Double Key Press
L1F9_7: LDW RC0, 2500 ;Change this value to adjust sensitivity
CALL DelayWW0
AND R_IFlags, 7F ;Clear key interrupt test bit
LD RF1, FF ;Enable key sense interrupts
L1F9_6: IDLE
TM R_IFlags, 80 ;Test key interrupt
JRNZ L1F9_3
TM R_IFlags, 20 ;Test timeout
JRZ L1F9_6

L1F9_5: LD W3, R03 ;Length of SHORT/SINGLE press side
CLR R03
L1F9_3: CP RC3, R03 ;Selected side empty?
JRLE L1F9_4 ;Yes
LD W4, R2D[W3] ;Get a key code
CP R_Mac, AR_MacBuf;Buffer full?
JRULE L1F9_4 ;Yes
PUSHUD @R_Mac, RC4 ;Insert KeyCode into pending keys
DJNZ W3, L1F9_3
L1F9_4: RET


My question is: When calling the keymove protocol, the hex values are placed in registers from R2D onwards ie. 1st hex cmd in R2D, 2nd in R2E, 3rd in R2F, 4th if R3A, 5th in R3B. The code above assumes that the keylength is in R3A. Why doesn't the 4th hex byte (if it exists) kill it?

I may be missing the obvious here, but wouldn't it go from R2f to R30 not R3a?

This would work mathematically since the readme for LKP says upto 13 keypresses are allowed
1 -2D
2 - 2E
3 - 2F
4 - 30
5 - 31
6 - 32
7 - 33
8 - 34
9 - 35
10 - 36
11 - 37
12 - 38
13 - 39

Oops.

Thanks, my hex is having a day out.