nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU