It looks like the "Backend" links (on hover state when listing sites at Super Admin -> Sites) are pointing to the current site's domain, if the primary domain is left at the original domain (i.e., not the mapped domain).
Main Site Real: 3.local Second Site Real: test.3.local Mapped: test.local
If I'm on the main site's site listing page, all "Backend" links return '3.local/wp-admin'.
If I'm on test.3.local (so real domain is the primary), all backend links return 'test.3.local/wp-admin'.
If I'm on test.local (so mapped domain is the primary), all "Backend" links return perfectly.
I've spent a while digging around the code, and I think I'm in the right general area, but haven't quite got it. I'm thinking the functions 'domain_mapping_adminurl()' and 'get_original_url()' need to make use of the $blog_id passed to the 'admin_url' filter (link-template.php line 1956).