Fix off-by-one in the vm_fault_populate() code.

When re-calculating the last inclusive page index after the pager
call, -1 was erronously ommitted. If the pager extended the run
(unlikely), the result would be insertion of the valid page mapping
outside the current map entry range.

Found by: alc
Sponsored by: The FreeBSD Foundation
MFC after: 1 week