CAMIOCOMMAND accepts kernel-internal XPT function codes that operate on kernel-only objects

Summary

Only func_code filter in passioctl is func_code & XPT_FC_XPT_ONLY. Every other XPT opcode reaches xpt_action(). Includes opcodes with kernel-only payloads: XPT_SASYNC_CB (registers user-supplied function pointer called from async-event context) XPT_ABORT (consumes kernel ccb pointer) XPT_DEBUG XPT_SET_TRAN_SETTINGS XPT_EN_LUN. XPT device restricts to whitelist; pass does not despite handling strictly more dangerous input. XPT_SASYNC_CB stores user callback verbatim (cam_xpt.c:3367) then xpt_async_bcast invokes it on matching event. On non-SMEP hardware user shellcode executes ring-0; on SMEP panics on event delivery = reliable DoS.