bus_dmamap_load() with map==NULL silently disables the tag's bounce constraints (segments returned with out-of-window addresses)

Summary

map==NULL substitutes the static nobounce_dmamap and skips bounce counting + per-page substitution: a COULD_BOUNCE tag returns raw physical addresses inside the exclusion window with no warning - a device programmed with such an address DMAs outside its addressable range (device-side RAM corruption). FreeBSD panics here; DFly silently violates. Needs a misusing driver (several in-tree NULL-map one-shot load sites). Loud-fail/document fix.