Fix DMA send bug

If length is 4, 0b100 was shifted over, which puts '00' into the
length field (correct), but pushed an extra '1' into the address
field (incorrect).