sglist_consume_uio loop does not check uio_iovcnt before reading uio_iov (defense-in-depth, dead code)

Summary

sglist_consume_uio (subr_sglist.c:402): while(resid>0 && uio_resid) no uio_iovcnt>0 check; iovcnt only decremented len==0 branch (:407). If caller passes uio with uio_resid>0 but all iov exhausted -> derefs uio_iov past iov array -> OOB read. Standard uio keeps resid consistent. Defense-in-depth. ZERO in-tree callers. Fix: add && uio_iovcnt>0.