fix memory boundary checking

legal access:
paddr + length <= vmi->size
illegal access:
paddr + length > vmi->size