Check that off <= lenmsg

Defense in depth, this should happen, but it happens... So check
for it and return an error.

Maybe (there is no testcase) fixes #106