Fix PMP NA4 region upper address calculation

This was missed when changing the return value from bytes to words.

model/riscv_pmp_control.sail

@@ -19,7 +19,7 @@ function pmpAddrRange(cfg: Pmpcfg_ent, pmpaddr: xlenbits, prev_pmpaddr: xlenbits
                // NA4 is not selectable when the PMP grain G >= 1. See pmpWriteCfg().
                assert(sys_pmp_grain() < 1, "NA4 cannot be selected when PMP grain G >= 1.");
                let lo = pmpaddr;
-               Some((lo, lo + 4))
+               Some((lo, lo + 1))
              },
     NAPOT => {
                // Example pmpaddr: 0b00010101111