vhost: fix double-free with zero-copy