Missing bounds check on cesr_element_type in chgetelemstatus allows OOB array index into sc_firsts/sc_counts

Summary

chgetelemstatus() takes int chet=cesr->cesr_element_type from u_int16_t user field and uses it directly as array index into softc->sc_counts[] and softc->sc_firsts[] (each int[CHET_MAX+1]==int[4]) without any > CHET_DT bounds check. Every sibling handler (chmove chexchange chposition chsetvoltag) performs this check first; chgetelemstatus is the sole outlier. Any chet in 4..65535 reads past array bounds. OOB-read value used to authorize rest of call and as sea argument to READ ELEMENT STATUS. cesr_element_count bounded only by OOB-read sc_counts[chet] so if OOB memory yields large positive value kmalloc(M_INTWAIT) can hang LWP forever providing reliable local DoS.