i965: Fix the bounds emitted in the vertex buffer packets.

It's the address of the last valid byte, not the address of the first
invalid byte.

This should also fix problems with rendering with the new sanity checks in
the kernel.

src/mesa/drivers/dri/i965/brw_draw_upload.c

@@ -539,12 +539,12 @@ static void brw_emit_vertices(struct brw_context *brw)
           if (input->stride) {
               OUT_RELOC(input->bo,
                         I915_GEM_DOMAIN_VERTEX, 0,
-                        input->offset + input->stride * input->count);
+                        input->offset + input->stride * input->count - 1);
           } else {
               assert(input->count == 1);
               OUT_RELOC(input->bo,
                         I915_GEM_DOMAIN_VERTEX, 0,
-                        input->offset + input->element_size);
+                        input->offset + input->element_size - 1);
           }
       } else
           OUT_BATCH(input->stride ? input->count : 0);