mailboxAlloc():  Fix another mailbox bug

Missed one in previous commit --- mboxptr->count and mboxptr->start were
not guaranteed to be initialized before mboxptr->state, potentially
creating a race with a concurrent call to mailboxCount().