ttm_bo_util: stale/uninitialized old_copy.bus snapshot drives iounmap() decision in ttm_bo_move_memcpy out: cleanup — kernel mapping leak, and full VRAM-aperture unmap when old BO sits at aperture offset 0

Summary

old_mem is snapshotted into old_copy BEFORE the io reserve populates old_mem->bus; when the NEW placement's ioremap fails, the out: cleanup's iounmap decision reads the stale copy - and that value is not merely stale: the accel/TTM/null move paths install a NEVER-initialized stack-garbage bus into bo->mem. Garbage-nonNULL skips a real iounmap (permanent kernel mapping + iomap_list leak per failed move); garbage-NULL with an old BO at aperture offset 0 makes old_iomap == aper_base_kaddr and DFly's exact-match iounmap unmaps and frees the ENTIRE global visible-VRAM aperture -> panic on next premapped access. Mitigating gates: memcpy path only when buffer_funcs disabled (SDMA-less/reset/suspend windows), offset 0 normally pinned by kernel allocs, garbage stack-layout dependent. Distinct from DF-1747 (out1 pairing) - fix both. Refresh-snapshot + memset-bus fix.