I've recently added code to indicate when a BNCH block is to follow, but the de-scrambled type-2 bits do not look plausible at all.
I've fixed the scrambling sequence computation now. And as zecke has found out how they really use the CRC, we now get correct CRC on most of our frames. Those that don't are probably speech frames that of course don't have a CRC...
So we now get the BNCH / SYSINFO PDU as well as some MAC-RESOURCE PDUs from SB2 and NDB bursts.