b43: Fix DMA buffer size handling

This fixes hidden bugs in the size handling of the DMA buffers.
This sets the RX buffer size to the theoretical max packet size and
fixes passing of the size values to the device (must not subtract the header offset).

These bugs are hidden and don't actually trigger due to the magic +100
offset for the buffer size.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>