can bcm: fix tx_setup off-by-one errors