e1000: fix access 4 bytes beyond buffer end