[PATCH] selinux: Fix MLS compatibility off-by-one bug