cam: fix UB behavior

The trick of subtracting one from the poitner returned from malloc
results in undefined behavior:

C89: 3.3.6 Unless both the pointer operand and the result point to a
member of the same array object, or one past the last member of the
array object, the behavior is undefined.

Instead, allocate 1 extra element and stop adjusting the pointer. While
a little wasteful, the extra is in the noise on today's systems.

Reviewed by: scottl@
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D30847