CAMGETPASSTHRU leaks stale kernel pointers and prior I/O data via whole-CCB bcopy

Summary

cam_periph_ioctl CAMGETPASSTHRU case pulls CCB from periph->ccb_list (reused pool) runs xpt_setup_ccb+xpt_action(XPT_GDEVLIST) which only init ccb_hdr routing fields and cgdl fields then bcopy(ccb addr sizeof(union ccb)) copies entire huge union ccb to userspace. Every ccb_hdr field not touched by xpt_setup_ccb - cbfcnp (kernel text pointer) periph_priv.entries[*].ptr sim_priv.entries[*].ptr path (kernel heap pointer) saved_ccb_ptr (=ppriv_ptr0 kernel heap pointer into periph softc) retry_count timeout - plus entire non-header union body (csio.cdb_io csio.data_ptr csio.sense_data from prior SCSI I/O) leaked verbatim. Yields KASLR bypass (cbfcnp function pointer into compiled driver code) plus kernel heap addresses and stale SCSI CDB/sense bytes. All CAM periph d_open gates SYSCAP_RESTRICTEDROOT so attacker already root-equivalent. Useful in capability-confined-root (jail with RESTRICTEDROOT) and as KASLR primer for subsequent kernel-exploit chain.