Two fixes:

1146,1149c1146
< 			if((td->cbp & ~0xFFF) == (td->cbp0 & ~0xFFF))
< 				bp->wp = pa2ptr(td->cbp);
< 			else
< 				bp->wp = bp->rp + 0x1000 + (td->cbp&0xFFF);
---
> 			bp->wp = bp->rp + (td->cbp - td->cbp0);

td->cbp and td->cbp0 are the real addresses corresponding
to virtual addresses bp->wp and bp->rp respectively.

The 'else' clause will make BLEN(bp) = (bp->wp - bp->rp) equal
to 0x1000 or greater, which can't be right because usb packets
are never that big!

If td->cbp and td->cbp0 are on different pages, the pages
must be adjacent (because no packet is greater than 4k),
and the corresponding virtual pages containing bp->wp and bp->rp
must also be adjacent (otherwise the mapping would be wrong).

So the replacement line works in all cases.

I've tested this and confirmed with Nemo that it's sensible.

1370a1368,1369
> 	if(ed == nil)
> 		return;

This "shouldn't happen" code prevents a panic which I've observed
but I'm too lazy to investigate.