target/arm: fix handling of HCR.FB