splice: fix user pointer access in get_iovec_page_array()