AVR-Chat

Ok, this must be something idiotic that I cannot figure out.
The Z register is being properly loaded with the correct
address of the string, but the string's bytes are never
loaded in r16. 
Why it always gets 0xff ? Obviously it is reading from 
somewhere else :-)
What's the trick ? 


; ----------------------------------------------------------
.include "m162def.inc"  ; includes the 162 definitions file
.cseg
.org 0x0000

    rjmp    INIT               ; this is a very silly program     
INIT:
    ldi     r16,LOW(RAMEND)    ; Initiatize Stackpointer
    out     SPL,r16            ; Needed otherwise returns from
    ldi     r16,HIGH(RAMEND)   ; calls go to 0000h
    out     SPH,r16            ;
;;    rcall   USART_init         ; will implement later.
String_out:                   ; load begin of string in Z
    ldi     ZH,high(Test_str)  ; Load Z register high    
    ldi     ZL,low(Test_str)   ; Load Z register low
loop1:                         ; come back here till done
    ld      r16,Z+             ; get byte and incr ptr
    cpi     r16,0              ; found the end ?
    breq    String_out         ; restart the loop
char_spit:
;;    rcall   USART_spit       ; will implement later
    rjmp    loop1      ;

.dseg    
Test_str:
    .db      "The old brown fox jumps over the lazy dog."
    .db      0x0d, 0x0a, 0