[IB] mthca: Fix off by one bug in mthca_map_cmd

The loop in mthca_map_cmd() would fill one entry past the end of the
mailbox buffer before calling the firmware command.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>