cam_periph_unmapbufs silently drops copyout errors -> data loss / inconsistent result

Summary

cam_periph_unmapbufs at cam_periph.c:830 /* XXX return error */ copyout return value DISCARDED. useracc at mapmem :712/:725 verifies range at mapmem time but does not pin pages. Concurrent munmap/mprotect between mapmem and unmapbufs copyout -> partial/failed copyout silently succeeds to xpt caller. XPT_DEV_MATCH: partial matches buffer. XPT_SCSI_IO: device data not propagated, xpt reports CAM_REQ_CMP. TOCTOU on user address space (self-inflicted or via shared memory with SETUID tool). No memory corruption (bounded by b_bcount<=MAXPHYS). Fix: plumb copyout error to caller.