thing is.... the knock counts are refreshed many times per second second. if it was in fact a datastream error the knock counts should go right back down. if it was interference on the bus you'd see tons of other data gone bad.

if the ccm or some other module is in fact injecting garbage despite the fact that you're bus master and they're supposed to stay quiet, the checksum will certainly be incorrect and that event --should-- be rejected but again the knock counts wouldn't stay up like that

i can (in the next few days) slip you a new beta version of eehack that in theory should reject all those events. although i intended to design eehack to reject anything but a perfect datastream, i seem to remember i found a few bugs concerning rejecting packets with bad lengths or bad checksums.