[kern] Really fix access violation in Format3

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11245

src/hb-ot-kern-table.hh

@@ -444,7 +444,7 @@ struct KernSubTableFormat3
     return_trace (true); /* Disabled.  See above. */
     return_trace (c->check_struct (this) &&
 		  c->check_range (kernValueZ,
-				  kernValueCount +
+				  kernValueCount * sizeof (FWORD) +
 				  glyphCount * 2 +
 				  leftClassCount * rightClassCount));
   }