pmalloc: u32 pp->index leads to va address overrun