vt: fix splash_cpu logos use of vd_drawrect

In the (extremely unlikely) case of vd->vd_height ==
vt_logo_sprite_height the vd_drawrect code would write outside of
frame-buffer memory.

MFC after:	1 week
Reviewed by:	cem
Differential Revision:	https://reviews.freebsd.org/D34220

(cherry picked from commit 06296f7)

sys/dev/vt/vt_cpulogos.c

@@ -135,8 +135,8 @@ vtterm_draw_cpu_logos(struct vt_device *vd)
 
 	a = teken_get_curattr(&tm->tm_emulator);
 	if (vd->vd_driver->vd_drawrect)
-		vd->vd_driver->vd_drawrect(vd, 0, 0, vd->vd_width,
-		    vt_logo_sprite_height, 1, a->ta_bgcolor);
+		vd->vd_driver->vd_drawrect(vd, 0, 0, vd->vd_width - 1,
+		    vt_logo_sprite_height - 1, 1, a->ta_bgcolor);
 	/*
 	 * Blank is okay because we only ever draw beasties on full screen
 	 * refreshes.