The "read crosses page" case in mget() needs to adjust the buffer
pointer in addition to the file offset and the transfer count.

This bug was exposed by enabling spread()'s cache, which causes a
"page crossing" every 8k--otherwise it's not clear to me that they
actually happen, which explains why nobody noticed the mistake.