fix another buffer underrun in mbox.c