drm/savage: fix integer overflows in savage_bci_cmdbuf()