bpf: fix sg shift repair start offset in bpf_msg_pull_data