nat: Test for a bug inside the TLV definition for GSM 08.08

The 0x1 inside a CIC IE could indicate a new IE... add test data
and test case to verify that the patching works correctly.
diff --git a/openbsc/tests/bsc-nat/bsc_nat_test.c b/openbsc/tests/bsc-nat/bsc_nat_test.c
index e1a17ac..4ab44de 100644
--- a/openbsc/tests/bsc-nat/bsc_nat_test.c
+++ b/openbsc/tests/bsc-nat/bsc_nat_test.c
@@ -446,13 +446,22 @@
 	msg = msgb_alloc(4096, "foo");
 	copy_to_msg(msg, ass_cmd, sizeof(ass_cmd));
 	parsed = bsc_nat_parse(msg);
+
+	if (msg->l2h[16] != 0 ||
+	    msg->l2h[17] != 0x1) {
+		fprintf(stderr, "Input is not as expected.. %s 0x%x\n",
+			hexdump(msg->l2h, msgb_l2len(msg)),
+			msg->l2h[17]);
+		abort();
+	}
+
 	if (bsc_mgcp_assign_patch(&con, msg) != 0) {
 		fprintf(stderr, "Failed to handle assignment.\n");
 		abort();
 	}
 
-	if (con.msc_endp != 21) {
-		fprintf(stderr, "Timeslot should be 21.\n");
+	if (con.msc_endp != 1) {
+		fprintf(stderr, "Timeslot should be 1.\n");
 		abort();
 	}
 
@@ -465,6 +474,16 @@
 		abort();
 	}
 
+	int multiplex, timeslot;
+	mgcp_endpoint_to_timeslot(0x1b, &multiplex, &timeslot);
+
+	uint16_t cic = htons(timeslot & 0x1f);
+	if (memcmp(&cic, &msg->l2h[16], sizeof(cic)) != 0) {
+		fprintf(stderr, "Message was not patched properly\n");
+		fprintf(stderr, "data cic: 0x%x %s\n", cic, hexdump(msg->l2h, msgb_l2len(msg)));
+		abort();
+	}
+
 	talloc_free(parsed);
 
 	bsc_mgcp_dlcx(&con);