Fix: Null buffer accounts for `offset` in `substring` kernel. (#1704)