Bug C: SMMU sticky-fault on VFE0 write master (iova=0, SID=0x820)

[asidko]

Symptom: after a camera session, the next preview open shows a black screen. dmesg fills with:

```
arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x520011, cbfrsynra=0x820, cb=12
arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x820
arm-smmu 15000000.iommu: FSYNR0 = 00520011 [S1CBNDX=82 WNR PLVL=1]
```

`SID=0x820` is the VFE0 write master. `iova=0` + WNR (write-not-read) + PLVL=1 means the VFE wrote to a level-1-unmapped iova zero.

Recovery: `sudo reboot` clears the SMMU context bank.

Root cause (per source read of `drivers/media/platform/qcom/camss/camss-vfe-17x.c` on `linux-6.14.7-sm7125`):

• `vfe_wm_start` enables `WM_CFG_EN` at the end of the function, without writing `WM_IMAGE_ADDR` first.
• Caller (`vfe_enable_output`) then loops `for (i = 0; i < 2; i++)` over pending buffers and calls `vfe_wm_update`, which programs `WM_IMAGE_ADDR`.
• If the pending queue is empty at the STREAMON instant (pipeline timing), `vfe_wm_update` never runs and the write master is enabled with `WM_IMAGE_ADDR` = 0 or stale from the previous session.
• `vfe_flush_buffers` does not NULL `output->buf[0/1]` after `vb2_buffer_done`, widening the stale-state window across STREAMOFF/ON cycles (this part is the long-known Bug B — also unfixed upstream).

Proposed fix (target v0.2.0):

1. Move the `writel(WM_CFG_EN | MODE_MIPI_RAW << WM_CFG_MODE, WM_CFG)` out of `vfe_wm_start` and into `vfe_wm_update` so the write master is only enabled after `WM_IMAGE_ADDR` is programmed.
2. Add `output->buf[i] = NULL` after each `vb2_buffer_done` in `vfe_flush_buffers` (3-line change — already specced upstream-submission-ready).

Both fixes are upstream-friendly. Will land in v0.2.0 after 2-expert review and a multi-session soak test.