CAM_DATA_PHYS / CAM_SG_LIST_PHYS accepted by pass allowing user-supplied raw physical DMA addresses to reach the SIM

Summary

passsendccb() treats CAM_DATA_PHYS only as hint to skip cam_periph_mapmem() - never rejects it. User issuing XPT_SCSI_IO with CAM_DATA_PHYS bypasses bounce-buffer copyin path entirely; user-supplied csio.data_ptr forwarded unmodified to SIM which interprets it as kernel/DMA address. XPT device explicitly rejects CAM_DATA_PHYS for XPT_DEV_MATCH (cam_xpt.c:1133). This asymmetry is defense-in-depth gap: if device node ever exposed to less-privileged subject (common FreeBSD operator-group relaxation) pass becomes arbitrary physical memory read/write primitive via storage controller. ahci SIM forwards value as-is to DMA engine without re-checking source. On systems without restricting IOMMU this is arbitrary kernel-memory read/write.