pdu: fix unpacking of LCG2 of LBSR MAC CE

LBSR packing is fine but this makes the eNB do wrong things
because it thinkgs LCG2 has no or too much data to send.

LCG2 is our default LCG for DRB1. One occasion we saw the issue
is doing full rate TCP DL which requires quite a bit of ACK traffic
back to the sender. With the BSR for LCG2 being wrong, providing
UL grants was delayed and so the TCP DL throuhgput was very low.

In the log below we see that the buff_size[2]=1 so there is data to send.
Interestingly, the packing was correct so Wireshark displays it correctly.
But the unpacking not, as can be seen in the MAC log below which reports
0 buffer state for all LCGs

22:08:54.804792 [MAC ] [I] [ 5084] pdu_get: sdu_len=1212, channel.sched_len=1213, bsr.buff_size[2]=1
22:08:54.804840 [MAC ] [I] [ 5084] UL LCID=3 len=1212 LBSR: b=0 0 0 0

lib/src/mac/pdu.cc

@@ -572,7 +572,7 @@ uint32_t sch_subh::get_bsr(uint32_t buff_size_idx[4], uint32_t buff_size_bytes[4
   if (ul_sch_ce_type() == ul_sch_lcid::LONG_BSR) {
     buff_size_idx[0] = (payload[0] & 0xFC) >> 2;
     buff_size_idx[1] = (payload[0] & 0x03) << 4 | (payload[1] & 0xF0) >> 4;
-    buff_size_idx[2] = (payload[1] & 0x0F) << 2 | (payload[1] & 0xC0) >> 6;
+    buff_size_idx[2] = (payload[1] & 0x0F) << 2 | (payload[2] & 0xC0) >> 6;
     buff_size_idx[3] = (payload[2] & 0x3F);
   } else {
     nonzero_lcg                    = (payload[0] & 0xc0) >> 6;