nvme_ctrlr_linux_passthru_cmd: correct size of upages_small array

The size broke when upages was converted from array to double pointer.

Reported by: gcc -Wsizeof-pointer-div
Reviewed by: imp
Fixes: 82ff1c334b97 ("nvme: Allow larger user request sizes")
Differential Revision: https://reviews.freebsd.org/D56368