target/riscv: Avoid NULL deref in IMSIC CSR write

rmw_xireg_aia() and rmw_xtopei() were changed to store the IMSIC callback's value in a local before passing it back to the caller. For write only CSR accesses that pointer is NULL, causing a crash when guest programs write to xireg or xtopei, such as when the guest sets up the IMSIC. This only happens when setting aia=aplic-imsic so none of the existing boot tests caught it. Fix it by guarding the pointer dereference as done for other CSRs. Fixes: 63469ad75dcc ("target/riscv: Fix arguments to board IMSIC emulation callbacks") Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Anton Johansson <anjo@rev.ng> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <20260617054034.1020724-2-joel@jms.id.au> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>