DRM2: fix off-by-one overflow in ioctl processing

Call to the driver-specific ioctl used to process ioctl number
that will lead to the out-of-bounds access to the ioctl handler
array.

PR: 193367
Approved by: kib
MFC of: r275209 (original commit by rea)