[media] vmalloc_sg: off by one in error handling