nbd: fix uaf in nbd_open