The #ss fault handler erronously does not check for the fault
originated from the return to usermode. #ss must be handled same as
#np.

Reported by: Andrew Lutomirski through secteam
Sponsored by: The FreeBSD Foundation
MFC after: 3 days