mac80211: fix possible out-of-bounds access