The firmware replaces the last 32-bit on RAM with a shared DRAM address.

The firmware replaces the last 32-bit on RAM with a shared DRAM address.
While the for-loop checks that thie value has changed since we wrote to
it, the timeout-condition checked for non-zero, which is wrong.  This
means that we didn't realize the firmware wasn't started.  While there,
make sure the shared DRAM address is inside the chip's address space.