link_elf_load_file() checks the symbol table's sh_link against
e_shnum with ">" instead of ">=", so a malformed object whose sh_link
equals e_shnum makes the linker read one entry past the section header
array before the sh_type check rejects it. Use ">=", as
link_elf_link_preload() already does.
Found while working on D60937.
MFC after: 1 week