DF-2532 — xdisk xa_start no-spans fail path KKASSERT panic
===========================================================

## Finding
`xa_start()` (sys/dev/disk/xdisk/xdisk.c:976-984) calls `xa_done(tag, 1)`
on the "no spans available, bio is allowed to fail" path without clearing
`tag->bio`.  `xa_done()` (xdisk.c:1009) opens with `KKASSERT(tag->bio == NULL)`
which is compiled in by INVARIANTS (enabled in X86_64_GENERIC) →
guaranteed kernel panic.

## Trigger
Any BIO with `B_FAILONDIS` set issued against an xa device with empty spanq.
This occurs during the disk framework's automatic label probe
(disk_setdiskinfo → DISK_DISK_PROBE → mbrinit reads with B_FAILONDIS).

## Build
```
# Harness module (deterministic trigger)
cc -DINVARIANTS -D_KERNEL ... -c df2532_harness.c   (via make / bsd.kmod.mk)
# Userland DMSG peer (supplementary)
cc -o df2532 df2532.c -Wall
```

## Run
```
# Harness: load + trigger (as root)
kldload ./df2532_harness.ko   # xdisk.ko must NOT be loaded
sysctl -w debug.df2532_trigger=1
# Expected (unpatched): panic: assertion "tag->bio == NULL" failed in xa_done at xdisk.c:1009

# Userland DMSG peer (as root, supplementary)
kldload xdisk
./df2532
```

## Expected (bug present)
Kernel panic: `assertion "tag->bio == NULL" failed in xa_done at xdisk.c:1009`

## Expected (after fix.diff)
No panic; xa_done runs cleanly; xa_release handles the bio with EIO.