ARM926: fix arm926ejs_mmu() reading from bad pointer

I'm suspecting this code can never have worked, since the
original commit (svn #335) in early 2008.

Fix is just copy/paste from another (working) function.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>