BMI address failure on unexpected messages

[carns]

David's experiences with stalled remove operations found another interesting BMI error case at bmi.c:987 ("critical" error within testunexpected()). It is possible on the server side for a BMI address to be discarded in between the time when an unexpected message is received and it being given to the daemon. Right now we react by returning an error out of testunexpected, but really we could just handle the problem individually on each buffer that lacks a corresponding BMI address, or else expand the reference count further to cover it.