Incomplete index validation in camq_remove; none in camq_change_priority

Summary

camq_remove at cam_queue.c:174 rejects index==0 || index>entries but accepts any negative index. camq_change_priority at :195 has NO bounds check on index at all, immediately derefs queue_array[index]->priority. queue_array is deliberately offset by -1 (cam_queue.c:78 queue_array--, :135 queue_array=new_array-1) so negative index dereferences memory before the kmalloc region. CAM subsystem defines negative sentinel indices CAM_UNQUEUED_INDEX=-1, CAM_ACTIVE_INDEX=-2, CAM_DONEQ_INDEX=-3 (cam.h:73-75) for not-on-this-queue; any future caller that forgets pre-filter turns one of these into heap OOB read/write. All current callers pre-validate (scsi_cd.c:418 gates pinfo.index!=CAM_UNQUEUED_INDEX; cam_xpt.c:3082 gates >=0; cam_xpt.c:3611 via periph_is_queued; cam_xpt.c:3669 via !=CAM_UNQUEUED_INDEX) so no live exploit. Defense-in-depth gap. Fix: tighten camq_remove to index<=0||index>entries and add same check to camq_change_priority.