Fix use of uninitialized where in zfs_range_add_reader

Under certain circumstances, zfs_range_add_reader will pass an undefined
where from avl_find() to avl_nearest(), which triggers a NULL pointer
dereference. That situation should call AVL_NEXT() instead. Otherwise,
we can see the following occur when assertions are enabled:

SPLError: 31638:0:(avl.c:222:avl_nearest()) ASSERTION(tree->avl_root == NULL) failed

Behavior when assertions are disabled was undefined.

Signed-off-by: Richard Yao <ryao@gentoo.org>