dhcpv6: fix out of bounds write in handle_nested_message()