arm64: Use pointer masking to limit uaccess speculation