zmp fixes (great track record here, eh?)
diff --git a/libtelnet.c b/libtelnet.c
index 93b4765..6999610 100644
--- a/libtelnet.c
+++ b/libtelnet.c
@@ -412,7 +412,7 @@
 			return 0;
 
 		/* count arguments */
-		while (c != telnet->buffer + telnet->buffer_pos + 1) {
+		while (c != telnet->buffer + telnet->buffer_pos) {
 			++argc;
 			c += strlen(c) + 1;
 		}
@@ -641,8 +641,9 @@
 						"unexpected byte after IAC inside SB: %d",
 						byte);
 
-				/* ready for next bytes */
+				/* enter IAC state */
 				start = i + 1;
+				telnet->state = TELNET_STATE_IAC;
 
 				/* process subnegotiation; see comment in
 				 * TELNET_STATE_SB_DATA_IAC about invoking telnet_recv()
@@ -655,7 +656,6 @@
 					 * as a regular IAC command.  we could use a goto, but
 					 * that would be gross.
 					 */
-					telnet->state = TELNET_STATE_IAC;
 					_process(telnet, (char *)&byte, 1);
 				}
 				break;