nfsd: Fix handling of negative lengths in read_buf()