Fix reverse copy off-by-one bug in memcpy