smalloc: fix off-by-one in ptr_valid()