BE11529 sometimes returns frame D with page_key=0x0000 (44 bytes), identical to the frame B response, inflating cfg to ~1115 bytes and mis-aligning all field offsets. Track (page_key, chunk_size) pairs and drop any repeat before appending to the running config buffer.