Well, isn't that special. We had the arguments to memcpy backward (probably
dating from the time when we use bcopy instead). So instead of copying bytes
of goodness into the zeroed nonce buffer, we were copying bytes out.
Net result: a nonce of zeros.