Bluetooth: Fix crash in l2cap_build_cmd() with small MTU