md: fix two raid10 bugs