Use crypto_contiguous_subsegment().
This driver used a home-rolled version that predated the function and didn't support mbufs.