ipa-firmware: Fix the write out of the firmware parts

Use the start address inside the header entry, the start is relative
to the surrounding SDP record which is located in our base offset, when
writing it out also ignore four bytes of something (crc?).
diff --git a/openbsc/src/ipaccess/ipaccess-config.c b/openbsc/src/ipaccess/ipaccess-config.c
index 33dd82a..93fe442 100644
--- a/openbsc/src/ipaccess/ipaccess-config.c
+++ b/openbsc/src/ipaccess/ipaccess-config.c
@@ -496,7 +496,7 @@
 		return;
 	}
 
-	target = sub_entry->absolute_offset;
+	target = sub_entry->absolute_offset + ntohl(sub_entry->header_entry.start) + 4;
 	if (lseek(fd, target, SEEK_SET) != target) {
 		perror("seek failed");
 		close(out_fd);
diff --git a/openbsc/src/ipaccess/ipaccess-firmware.c b/openbsc/src/ipaccess/ipaccess-firmware.c
index d1004ea..bc40c1e 100644
--- a/openbsc/src/ipaccess/ipaccess-firmware.c
+++ b/openbsc/src/ipaccess/ipaccess-firmware.c
@@ -117,7 +117,7 @@
 
 		header_entry = talloc_zero(header,  struct sdp_header_item);
 		header_entry->header_entry = entry;
-		header_entry->absolute_offset = lseek(fd, 0, SEEK_CUR);
+		header_entry->absolute_offset = base_offset;
 		llist_add(&header_entry->entry, &header->header_list);
 
 		/* now we need to find the SDP file... */