qcow2: Fix access after end of array