Fix bug in payload length writing