Can't decompress raw block backwards on 6502

[sasq64]

Likely my own fault but I have;

• Compressed data using

        auto packed_size =
            lzsa_compress_inmem(..., LZSA_FLAG_RAW_BACKWARD | LZSA_FLAG_RAW_BLOCK, 0, 1);

• Verified the result using the lzma command line tool

• Using 6502/decompress_fast_v1.asm for decompression, with -DBACKWARDS_DECOMPRESS=1

• Packed data is at $880, unpacker at $400

• Passing the address of the last byte (end-1) as source and a high memory location ($c000) as dest

I see the unpacker running, first reading 3 bytes, and then just writing and reading one byte at a time, going further and further down in memory, way past the beginning of the packed data, until it hits the depacker routine (at $400) and crashes.

The first 3 bytes read are the last 3 bytes of the compressed data (0x70 0x2c 0x00, in reverse order) like expected.

Any idea what could be wrong?