pn80t,docs: fix cooldown APDU

The cooldown APDU should take the format
  FF XX 00 00
This change fixes that before it goes into common
use.

Test: builds and works from ese-replay
Bug: none
Change-Id: Ia9562910411d401bfd1bdb62a1fbad470abf408f
diff --git a/apps/boot/README.md b/apps/boot/README.md
index 144c0f2..0c5a411 100644
--- a/apps/boot/README.md
+++ b/apps/boot/README.md
@@ -263,7 +263,7 @@
 chips that support it, like the one this applet is being tested on, the cooldown
 time can be requested with a special payload to ese\_transceive():
 
-    FFFF00E1
+    FFE10000
 
 In response, a 6 byte response will contain a uint32\_t and a successfuly
 status code (90 00).  The integer indicates how many minutes the chip needs to
diff --git a/libese-hw/nxp/pn80t/common.c b/libese-hw/nxp/pn80t/common.c
index 12aa223..5ea20a1 100644
--- a/libese-hw/nxp/pn80t/common.c
+++ b/libese-hw/nxp/pn80t/common.c
@@ -212,7 +212,7 @@
                                          uint32_t tx_len,
                                          struct EseSgBuffer *rx_buf,
                                          uint32_t rx_len) {
-  /* Catch proprietary, host-targeted calls FF FF 00 XX */
+  /* Catch proprietary, host-targeted calls FF XX 00 00 */
   static const uint32_t kCommandLength = 4;
   static const uint8_t kResetCommand = 0x01;
   static const uint8_t kGpioToggleCommand = 0xe0;
@@ -223,10 +223,10 @@
   if (ese_sg_to_buf(tx_buf, tx_len, 0, sizeof(buf), buf) != kCommandLength) {
     return 0;
   }
-  if (buf[0] != 0xff || buf[1] != 0xff || buf[2] != 0x00) {
+  if (buf[0] != 0xff || buf[2] != 0x00 || buf[3] != 0x00) {
     return 0;
   }
-  switch (buf[3]) {
+  switch (buf[1]) {
   case kResetCommand:
     ALOGI("interface command received: reset");
     if (nxp_pn80t_reset(ese) < 0) {