bus_dmamap_sync was using xs->flags to determine which direction to sync the map. unfortunately xs is not set for internal ciss commands, so this is a null deref. it wasnt until kettenis made bus_dmamap_sync a real function which needed its arguments evaluated that this became a real problem though.
bus_dmamap_sync was using xs->flags to determine which direction
to sync the map. unfortunately xs is not set for internal ciss
commands, so this is a null deref. it wasnt until kettenis made
bus_dmamap_sync a real function which needed its arguments evaluated
that this became a real problem though.

hit by mcbride@ and sakurai-san. fixed by krw@ over my shoulder
when we figured out which specific chunk of code was faulting.
tested by sakurai-san
ok krw@ deraadt@

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars