bin/cscan: fix $xml usage confusion in source