Ok, so the real issue Coverity has is the tainting of nX.

Have zmodem_recv_nibble() explicitly range-check all values, and
handle negative values.  If this remains an issue, it can be
untainted with range checks on each nibble, but let's not go there
to start with.