msi_setup/msi_map perform no bounds validation on intr/cpuid before indexing fixed-size arrays and programming the IDT

Summary

msi_setup at msi.c:433 indexes msi_intr[intr] (192-element table) and calls setidt(0x20+intr,...) with NO check that 0<=intr<IDT_HWI_VECTORS=192. setidt (machdep.c:1745-1759) validates cpu but NOT idx, so OOB intr would OOB-read function-pointer table AND OOB-write per-CPU IDT yielding kernel RIP control on next interrupt. msi_map at :443 expands CPUID_TO_APICID(cpuid) to cpu_id_to_apic_id[cpuid] (256-element) with NO check, so OOB cpuid OOB-reads kernel int packed into MSI address register written to PCI config space (readable via pciconf) = info leak. All current callers (icu_abi.c:535/619-623, ioapic_abi.c:1332/1417-1418) wrap in KASSERT bounds (compiled out in production) and MSI allocation loops bound intr<i+count<=HWI_VECTORS. NO reproducible attacker path today; latent defense-in-depth gap. Fix: add always-on bounds check at the function performing dangerous indexing.