TOCTOU on user-supplied chio.h ioctl structs enables re-validation bypass in move/exchange/position/setvoltag

Summary

chioctl passes user-mode ap->a_data pointer straight into handlers without copyin; chmove/chexchange/chposition/chsetvoltag re-dereference same struct member multiple times across validation check and later use. A concurrent thread mutating cm->cm_fromtype between > CHET_DT rejection and subsequent sc_counts[cm->cm_fromtype] indexing can race validator into OOB array access. Each field read 3-4 times per call expanding race window. Multi-threaded spinner can repeat millions of times to land modification between validator and first use.