Are data payload packets embedded inside a ZBTxRequest packet? i.e. a packet inside a packet?

I am sending a 40-byte payload from an S2 Xbee (XB24-ZB, ZigBee End Device AT, firmware 28A7) to an Pro S2B (XBP24BZ7, ZigBee Coordinator API, firmware 21A7) and I inconsistently receive either a 71 or 72 byte length frame packet on the receiving end.

Upon inspection with XCTU on the receiving end it seems like there is a second packet embedding the data payload - ZBRxResponse.getData() returns the embedded packet which also seems to start with 0x7E.

I’m a bit confused as my data starts at byte position 18 of the internal data packet, however the getDataOffset() returns 11. I verified this by sending an easily identifiable hardcoded 40-byte payload 99 99 99 99…

The only parameters I have set on the Xbee’s are ID and NI, the rest is default values.

Here are both packets in detail:

And my code of course:

Tx Code:
Rx Code:

Thanks for any help and have a great evening!

UPDATE: Solved my own problem. It was caused by using AT firmware on the transmitting Xbee. Once the latest API End Device firmware was implemented it worked precisely as expected.

Yes the data payload is embedded within the API receive frame as depicted within the manual.