scsi: sg: Re-fix off by one in sg_fill_request_table()