Convert another tmpfs assert into runtime check.

The offset of the directory file, passed to getdirentries(2) syscall,
is user-controllable. The value of the offset must not be asserted,
instead the invalid value should be checked and rejected if invalid.

Reported and tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week