Fix for the missing buffer segment.

Whoops.  In the enqueue step, req_off really does start
at 0, and ranges to msg_cnt-1.

Signed-off-by: Matt Benjamin <matt@linuxbox.com>