Kernel pointer leak to userspace via unconditional bcopy of full union ccb on CAMIOCOMMAND completion

Summary

On every CAMIOCOMMAND passsendccb() bcopies entire kernel-side union ccb (~1.5KB) back into user ioctl buffer. Only ccb_h.cbfcnp sanitized and only ccb_h.periph_priv restored. Every other kernel-private pointer field leaked verbatim: ccb_h.path (kernel heap pointer to cam_path) ccb_h.timeout_ch (kmalloc callout) ccb_h.sim_priv (kernel pointer to ahci_port) ccb_h.periph_links (stale SLIST pointer from SLIST_REMOVE_HEAD which does not clear sle_next). Defeats KASLR for attacker who already controls root. Deterministic leak of 3-6 kernel addresses per call. CAM-wide hygiene defect also in cam_xpt.c:1078 1117.