mlx4_core: Fix possible chunk sg list overflow in mlx4_alloc_icm()