cam_periph_mapmem() and cam_periph_unmapmem() map the user-provided
struct mmc_data for XPT_MMC_IO CCBs, but use sizeof(struct mmc_data *)
instead of sizeof(struct mmc_data) as the length. Only the pages
covering a pointer are mapped, so accessing a field past the first
pointer-sized region (for instance cmd->data->flags) faults if the
structure happens to straddle a page boundary and the following page is
not mapped.
The failure is intermittent because it depends on where the caller places
the struct mmc_data. Issuing a CMD53 CCB through pass(4) to an MMCCAM
SDIO card whose struct mmc_data lands at the end of a page panics with
"data abort in critical section or under mutex" in the host driver.
Map the whole structure in both the map and unmap paths.
MFC after: 1 week