IB/core: Fix a potential array overrun in CMA and SA agent