Fix an off-by-one bug in createSubBuffer size validation