XPT_DEV_MATCH reads num_patterns without bounding by pattern_buf_len: kernel heap OOB read

Summary

cam_periph_mapmem validates only pattern_buf_len non-zero and <=MAXPHYS. Never compares num_patterns*sizeof(struct dev_match_pattern) against pattern_buf_len. xpt_action XPT_DEV_MATCH iterates for(i=0;i<cdm->num_patterns;i++) cdm->patterns[i].type. xptbusmatch/xptdevicematch/xptperiphmatch read patterns[i].pattern.* fields. User sets pattern_buf_len=sizeof(struct dev_match_pattern) (one element) num_patterns=thousands kernel reads past mapped bp->b_data (pbuf MAXPHYS bytes) into adjacent kernel heap. Two impacts: (1) DoS reading past pbuf into unmapped kernel address space page-faults (2) info leak read values drive match decisions attacker crafts patterns observes matches infers neighbouring heap bytes. xpt0 mode 0600 root-only. XPT_DEV_MATCH has XPT_FC_XPT_ONLY rejected on pass devices.