sao: fix signed loop bounds bug