From 249cd05906c6ecd475fe5089b8d7d1e29985b159 Mon Sep 17 00:00:00 2001
From: OpenCode <agent@opencode.ai>
Date: Fri, 11 Sep 2026 17:11:27 +0800
Subject: [PATCH] fix: build_rdm_frame checksum off-by-one (summed 1 extra byte
 incl. stale template checksum)

Default mode RDM discovery got 0 responses because the template-based builder's
checksum range was 0x3C..0x3C+msgLen (includes the old checksum slot) instead of
0x3C..0x53+PDL. build_rdm_frame2 was already correct (used by show mode).
---
 src/hostdemo.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/hostdemo.rs b/src/hostdemo.rs
index 95815c1..3d6949e 100644
--- a/src/hostdemo.rs
+++ b/src/hostdemo.rs
@@ -93,9 +93,10 @@ fn build_rdm_frame(dest: &[u8; 6], tn: u8, qseq: u16, cc: u8, pid: u16, pd: &[u8
     f[0x51] = (pid & 0xFF) as u8;
     f[0x52] = pd.len() as u8;
     f[0x53..0x53 + pd.len()].copy_from_slice(pd);
-    // checksum: 含隐式 0xCC 起始字节, 从 CC 起 msgLen 字节 (不含自身), BE
+    // checksum: 含隐式 0xCC 起始字节, Σ(0x3C..0x53+PDL) (不含 checksum 槽位自身!), BE
+    // ★历史 bug: 曾写成 0x3C..0x3C+msg_len 多算 1 字节(含模板残留旧 checksum) → Butler 不应答
     let mut sum: u16 = 0xCC;
-    for i in 0x3C..0x3C + msg_len { sum = sum.wrapping_add(f[i] as u16); }
+    for i in 0x3C..0x53 + pd.len() { sum = sum.wrapping_add(f[i] as u16); }
     let cs = 0x53 + pd.len();
     f[cs] = (sum >> 8) as u8;
     f[cs + 1] = (sum & 0xFF) as u8;