mei: fix potential read outside of array bounds