We do not want to cause a panic from the panic handler.

It could be argued that bo->vfc cannot possibly be NULL, except
when it is - and that's what we got the panic handler for.

vfc->failed is output by pan_vfp now so I should have removed
that duplication when introducing pan_vfp