Seen testing with a Motorola 5G phone.

The buffer.advance(1) here skips over the peeked IEI type:

 0x55 => {
    buffer.advance(1); // Skip IEI
    message.maximum_number_of_supported_packet_filters = Some(NasMaximumNumberOfSupportedPacketFilters::decode(buffer)?);
 },

...but NasMaximumNumberOfSupportedPacketFilters::decode() then wrongly takes 3 bytes instead of 2.

The result is that the next IEI offset is wrong, we go into the 'unknown IEI' case, and the library asserts.