fix off-by-one in acl match iteration