vdpa: Fix pointer math bug in vdpasim_get_config()