libndr: fix ndr_size_* calculation with relative reverse buffers