sa_find_sizes() may compute wrong SA header size

Fix for SA corruption when multiple variable-length SAs are stored in the bonus buffer.