9p/virtio: fix off-by-one error in sg list bounds check