lib/mpi: Fix buffer overrun when SG is too long