blobmsg: fix wrong payload len passed from blobmsg_check_array