# DF-1051 — sgopen unlocks unheld lock + releases unacquired periph

## Summary
`sgopen` at `sys/bus/cam/scsi/scsi_sg.c:395-399` calls
`cam_periph_unlock(periph)` in the `securelevel > 1` error path BEFORE
`cam_periph_lock()` is acquired at line 400 — releasing a `lockmgr` lock
the caller does not own → `lwkt_reltoken: illegal release` panic.

Additionally `sgopen` is missing the `cam_periph_acquire()` that sibling
`ptopen` (`scsi_pt.c:154`) makes; every `cam_periph_release()` in
`sgopen` (`:397`, `:414`) and `sgclose` (`:437`) underflows the periph
refcount from 0 → 0xFFFFFFFF, breaking hot-unplug cleanup.

## Trigger
Local root (`SYSCAP_RESTRICTEDROOT`):

```
sysctl kern.securelevel=2
cc -o sg_securelevel_panic sg_securelevel_panic.c
./sg_securelevel_panic
```

Unpatched kernel panics. Patched kernel returns EPERM cleanly.

## Build / Run
```
./build.sh    # cc -o sg_securelevel_panic sg_securelevel_panic.c
sysctl kern.securelevel=2     # as root, before ./run.sh
./run.sh
```

## Fix
`fix.diff` adds the missing `cam_periph_acquire` and removes the spurious
unlock in the securelevel path, mirroring `ptopen`. Validated on a single-fix
kernel build (#1, sha256 bcfe20d5…): no panic, open returns EPERM.