ion: fix crash when alloc len is -1