Kernel heap OOB read in cdreaddvdstructure() default case via short-transfer underflow

Summary

In cdreaddvdstructure() default case dvdstruct->length computed as length-ccb->csio.resid-sizeof(header) in mixed int/u_int32_t/size_t arithmetic wraps to huge value when device returns short transfer (resid>length-4) with CAM_REQ_CMP status. Subsequent bcopy reads min(sizeof(dvdstruct->data)=2048 dvdstruct->length)=2048 bytes from databuf+4 even for small DVD structure formats whose databuf kmalloc as little as 8 bytes. Up to ~2044 bytes of adjacent kernel heap copied into dvdstruct->data which is user-supplied ioctl argument buffer copied back to userspace by IOWR semantics. Formats reaching default branch with length<2052 all vulnerable. Attacker: malicious SCSI/USB device plus SYSCAP_RESTRICTEDROOT opener. Device answers READ DVD STRUCTURE (opcode 0xad) for small format (MEDIUM_STAT) with GOOD status and 0-3 bytes transfer. cdrunccb returns success CAM_REQ_CMP post-read switch falls through to default underflowed dvdstruct->length drives 2048-byte bcopy from 8-byte databuf. DVDIOCREADSTRUCTURE is _IOWR ioctl handler aliases addr directly to dvdstruct kernel-resident alias 2048 leaked heap bytes land in caller struct dvd_struct returned to userspace. Impact: kernel heap info leak up to 2048 bytes per call useful for KASLR bypass and follow-on RCE attempt.