[os_xml] fix possible array underflows: see coverity