tg3: fix length overflow in VPD firmware parsing