vdev_read_pad2: freeing wrong pointer
Shoud free previously allocated tmp buffer instead. Issue introduced in r357497.
Reported by: rpokala