MFC: r255866, r255867

  fix a bug where we access a bread buffer after we have brelse'd it...
  The kernel normally didn't unmap/context switch away before we accessed
  the buffer most of the time, but under heavy I/O pressure and lots of
  mount/unmounting this would cause a fault on nofault panic...

  NULL stale pointers (should be a no-op as they should no longer be
  used)...