fix minor infoleak in get_user_ex()