binder: Don't modify VMA bounds in ->mmap handler