ARM926: fix arm926ejs_mmu() reading from bad pointer