vm: fix vm_pgoff wrap in upward expansion