regression from dcad3ac4

    coverity#1242624 Untrusted loop bound

    Change-Id: Idf52c09828c2bab767e9ff0d07b61befd6bfc64b

The original code read 8 bytes on the nElemSizeVert == 8
branch and always 4 otherwise. I assumed that nElemSizeVert had
to be read as 4 on that branch, but apparently not. So if its
not 4, set it to 4 and we get the same behaviour as originally
and continue to ensure we bounds check the loop

Change-Id: Ica8ab7cc3bbebee93216766a2e1279a579494840