AX.25: Fix out-of-bounds read in ax25_connect()