PROBE_SERIAL_NUM_1 OOB-read of VPD 0x80 response and XPT_GDEV_TYPE overflow of cgd->serial_num[252]

Summary

Two coupled bugs driven by malicious SCSI device VPD page 0x80 response. (1) PROBE_SERIAL_NUM_1 reads serial_buf->length (u_int8_t device-controlled max 255) does bcopy(serial_buf->serial_num dev->serial_num serial_buf->length) but serial_buf->serial_num is u_int8_t[251] inside 255-byte struct any length>251 reads 1-4 bytes past kmalloc buffer into adjacent kernel heap. (2) XPT_GDEV_TYPE copies dev->serial_num_len bytes (now up to 255) into cgd->serial_num[252] via bcopy 3-byte overwrite of cgd->reserved cgd->serial_num_len one byte past struct ccb_getdev within union ccb. Leaked heap bytes propagated to user via bcopy(ccb inccb sizeof(union ccb)) in xptioctl. Requires malicious SCSI target device (USB mass storage FireWire Thunderbolt Fibre Channel iSCSI) returning VPD 0x80 with length>=252. Impact: 4-byte heap OOB read per probe leaking adjacent kmalloc data into dev->serial_num propagated via XPT_GDEV_TYPE/XPT_DEV_MATCH root-only query. 3-byte CCB field corruption internal.