sgread: tsleep on local stack address &hstat has no wakeup source; read() blocks indefinitely (local DoS)

Summary

In sgread() when user-supplied pack_id does not match any queued sg_rdwr the code drops periph lock and calls tsleep(&hstat PCATCH sgnull 0). hstat is uninitialized stack local. The wakeup address &hstat is unique to this stack frame; sgdone() only ever calls wakeup(rdwr) or wakeup(&done_ccb->ccb_h.cbfcnp) - never wakeup(&hstat). Therefore this tsleep can only return via a signal (PCATCH) i.e. read() blocks indefinitely until process is signaled. hstat uninitialized at tsleep time makes channel identifier accidental. Self-DoS / process-table pressure vector.