Fix nonce calculation.
Well, isn't that special. We had the arguments to memcpy backward (probably dating from the time when we use bcopy instead). So instead of copying bytes of goodness into the zeroed nonce buffer, we were copying bytes out. Net result: a nonce of zeros.