Fix off-by-one read in r_cons_memcat