ipv6: fix out of bound writes in __ip6_append_data()