spi_flash_mmap_page_num_init() passed a literal 128 while the ROM searches
Cache_Get_DROM_MMU_End() / 4 entries -- 256 on esp32c5, c6, h2 and s3 -- so
its free-page scan ran off the array and judged entries from stale heap bytes.
The refcount bump on the commit path indexes the same way, so a mapping placed
above entry 127 also writes past the array and corrupts the heap behind it.
esp32c61 and esp32h21 have the ROM mmap but never program the size and have no
soc/mmu.h to read it from, so they keep 128.