PMP LogOp_MapOut fixes

* Fix caching of page table entry flags (was never updating R9, so the
flags would be recalculated for every page)
* Fix use of flag in bottom bit of R6; if the flag was set, the
early-exit case for having made all the cacheable pages uncacheable will
never be hit, forcing it to loop through the full page list instead

s/ChangeDyn

@@ -3327,7 +3327,7 @@ LogOp_MapOut ROUT
         MOV     r6, r0, LSL #12
         ARMop   Cache_RangeThreshold,,,r12
         CMP     r6, r0
-        ORRLS   r6, r6, #1
+        SUBLS   r6, r6, #1
 
         MOV     r7, r3
         LDR     r12, [r12, #CamEntriesPointer]
@@ -3335,11 +3335,11 @@ LogOp_MapOut ROUT
         LDR     r10, =L2PT
         MOV     r9, #-1
 05
-        LDR     r2, [r7], #4
+        LDR     r11, [r7], #4
       [ PMPDebug
-        DebugReg r2, "Uncache page "
+        DebugReg r11, "Uncache page "
       ]
-        ADD     r11, r12, r2, LSL #CAM_EntrySizeLog2
+        ADD     r11, r12, r11, LSL #CAM_EntrySizeLog2
         ASSERT  CAM_LogAddr=0
         ASSERT  CAM_PageFlags=4
         LDMIA   r11, {r11, lr}
@@ -3351,6 +3351,7 @@ LogOp_MapOut ROUT
         CMP     r9, lr
         BEQ     %FT06
         LDR     r1, =ZeroPage
+        MOV     r9, lr
         LDR     r1, [r1, #MMU_PCBTrans]
         GetTempUncache r2, lr, r1, r4
 06