Fixed bug #305: Scan with preferredPositionInResponse <= -2 crashes.