Control-device ioctl path leaks cam_periph_lock (SIM-wide deadlock)

Summary

saioctl() unconditionally acquires SIM lock at scsi_sa.c:849. Three early return statements inside SA_IS_CTRL(dev) switch bypass single exit at 1342-1345 that releases lock: line 878 (MTIOCERRSTAT cam_periph_hold interrupted by signal) line 914 (MTIOCTOP/MTIOCSETEOTMODEL cam_periph_hold interrupted) line 920 (any unknown ioctl on control device). After any return SIM lockmgr lock held permanently deadlocking every subsequent operation against any device on that SCSI host not just tape unit. Early returns written assuming cam_periph_hold failing means no lock state needs unwinding but cam_periph_lock was taken 9 lines earlier independent of cam_periph_hold. Non-recursive lockmgr any subsequent thread calling cam_periph_lock on same SIM blocks forever. Privileged user with SYSCAP_RESTRICTEDROOT issues ioctl on /dev/sa0.ctl hitting default: return(EINVAL) permanently wedges entire SCSI host.