Fix generation of GPRS Routing Area in case of 3-digit MNC

This fixes a simple typo that causes erroneous GPRS Routing Area
encoding if you use 3-digit MNCs.
diff --git a/src/gsm/gsm48.c b/src/gsm/gsm48.c
index 44baec6..379ed65 100644
--- a/src/gsm/gsm48.c
+++ b/src/gsm/gsm48.c
@@ -406,7 +406,7 @@
 		buf[2] = ((mnc / 10) % 10) | ((mnc % 10) << 4);
 	} else {
 		buf[1] |= (mnc % 10) << 4;
-		buf[2] = ((mnc / 100) % 10) | (((mcc / 10) % 10) << 4);
+		buf[2] = ((mnc / 100) % 10) | (((mnc / 10) % 10) << 4);
 	}
 
 	*(uint16_t *)(buf+3) = htons(raid->lac);