fix segfault when trying to dequeue list head as list element

diff --git a/src/subchan_demux.c b/src/subchan_demux.c
index 78ba2da..d8bf29f 100644
--- a/src/subchan_demux.c
+++ b/src/subchan_demux.c
@@ -202,13 +202,13 @@
 
 		/* make sure we have a valid entry at top of tx queue.
 		 * if not, add an idle frame */
-		if (llist_empty(&sch->tx_queue))	
+		if (llist_empty(&sch->tx_queue))
 			alloc_add_idle_frame(mx, subch);
 	
 		if (llist_empty(&sch->tx_queue))
 			return -EIO;
 
-		txe = llist_entry(&sch->tx_queue, struct subch_txq_entry, list);
+		txe = llist_entry(sch->tx_queue.next, struct subch_txq_entry, list);
 		num_bits_left = txe->bit_len - txe->next_bit;
 
 		if (num_bits_left < num_requested)
@@ -291,7 +291,7 @@
 	tqe->bit_len = len;
 	memcpy(tqe->bits, data, len);
 
-	llist_add(&tqe->list, &sch->tx_queue);
+	llist_add_tail(&tqe->list, &sch->tx_queue);
 
 	return 0;
 }