fix inefficient choice of tlsdesc function due to off-by-one