cptofs short write handling appears broken

[ddiss]

On short write, copy_file() currently attempts to write any remainder from a source buffer address after the full read length.
I've not actually triggered this code-path, but it's a theoretical buffer overrun, so figured it's worth raising a ticket here. Fix:

-                               ptr += len;
+                               ptr += wrote;

I'll submit it soon, but want to add some test coverage for cptofs first.