btrfs: subpage: fix wild pointer access during metadata read failure