libertas: fix buffer handling of PS_MODE commands and responses

libertas: fix buffer handling of PS_MODE commands and responses

Commit 5b8845345e7385d2eb37fac22ba9ab6905988be5 (or, in case the git
workflow is broken and patches get recommitted, the commit entitled
'libertas: rename and re-type bufvirtualaddr to cmdbuf' by dcbw),
introduced a number of bugs where we once had a pointer to a command
_payload_, but now we use the pointer to the command header instead.

The fix isn't wonderfully pretty for now, but it'll get better when we
finish converting all commands so the structures include the header.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>