ceph: fix off by one bugs in unsafe_request_wait()