test/misc-malloc: fix data corruption in worker thread

We capture len and tf by reference, even though they are stack variables
that immediately go out of scope.

Change to capture by value. Fixes #370.

Signed-off-by: Avi Kivity <avi@cloudius-systems.com>
Signed-off-by: Pekka Enberg <penberg@cloudius-systems.com>