ar71xx: fix invalid pointer dereference in rb95x_nand_scan_fixup()