Harden capability parsing

Don't check only the number of capabilities but also the remaining size in the stream.