sastart ERR_PENDING drain uses stale bio pointer after goto again -> double biodone, queue corruption, bio UAF

Summary

sastart at scsi_sa.c:1603-1625 ERR_PENDING drain loop: bio set once at :1590 (outside if/else). EOF_PENDING sub-branch :1615 does biodone(done_bio) at :1624 then goto again at :1625 WITHOUT refreshing bio. again: at :1603 re-enters -> queue_count-- (underflow), bioq_remove on already-removed bio (TAILQ corruption), bio->bio_buf UAF read, bp->b_resid UAF write, biodone(done_bio) second time (double biodone on freed/reused buf per vfs_bio.c:3746 WARNING). Trigger: tape read in fixed-block mode returns FILEMARK sense with >=2 reads outstanding -> saerror sets SA_FLAG_EOF_PENDING -> next sastart fires. Malicious SCSI/iSCSI tape target (T_SEQUENTIAL) returns CHECK CONDITION with SSD_FILEMARK. Local: root opens /dev/sa0 MTSETBSIZ fixed-block then async reads across filemark. Fix: bio=bioq_first(&softc->bio_queue) before goto again.