Use scan context for initial peek as well. Peek 6 bytes in the initial
peek rather than 5 bytes, to match the length of the memcmp we're doing
on that data later. Return immediately when we found caps from looking
at the beginning of the data - no point in continuing to scan the next
64kB for something matching a frame header.