bz10996: fix buffer underrun in mbox.c