brcmfmac: rework scatter-gather code in brcmf_sdio_buffrw()