sendmmsg/sendmsg: fix unsafe user pointer access