carl9170 firmware: fix array-out-of-bounds bug