xan: Fixed out of bound accesses in xan_unpack()