MFC: r255866, r255867

  fix a bug where we access a bread buffer after we have brelse'd it...
  The kernel normally didn't unmap/context switch away before we accessed
  the buffer most of the time, but under heavy I/O pressure and lots of
  mount/unmounting this would cause a fault on nofault panic...

  NULL stale pointers (should be a no-op as they should no longer be
  used)...
MFC r255648:

Fix a typo when accounting for tx_broadcast statistics.

Submitted by:	Paul A. Patience <paul-a patience polymtl ca>
Merge remote-tracking branch 'upstream-github/stable/9' into stable/9