bt: rewrite csrhci_write to avoid out-of-bounds writes