Actually zero the bytes.

This was missing the ^ for xor.  Spotted by @jrick.