Fix bad arithmetic in umtx_key_get() to compute object offset.

It looks like umtx_key_get() has the addition and subtraction the wrong
way around, meaning that it fails to match in certain cases. This causes
the cloudlibc unit tests to deadlock in certain cases.

Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D3287