Oopsies! The "bytes to follow" is a word length. I added a zero byte above and updated CK_B. Still untested, as I do not have that hardware, but it is more likely to work now. 
Cheers,
/dev
P.S. After coding it up and sending it to the Neo 6M, I found that the version 4.0 field should have been 0x40, not 4. updated above...