XPT_MMC_IO maps two nested buffers: cmd.data, then cmd.data->data whose
address is derived from cmd.data. cam_periph_unmapmem() restored them in
forward order, so it put cmd.data back to its userspace value and then
dereferenced that pointer to reach cmd.data->data from kernel context,
panicking in vm_fault_lookup().
Unmap in reverse order, mirroring how the mappings were created. This is
a no-op for single-buffer func_codes and for the other two-buffer cases
(XPT_DEV_MATCH, XPT_SMP_IO), whose buffers are independent.
The bug is only reachable via the pass(4) userspace path, which maps and
unmaps CCB buffers; in-kernel MMCCAM consumers never call
cam_periph_{map,unmap}mem(). Triggered by a userspace SDIO CMD53
transfer from sdiotool(8) through pass(4).
MFC after: 1 week