sgwrite/sgread leak sg_rdwr + ccb + buf when read() is never matched; sgoninvalidate/sgcleanup never drain rdwr_done (memory exhaustion + invalidation UAF surface)

Summary

sgwrite() kmallocs sg_rdwr xpt_alloc_ccb() CCB and optionally buf queues rdwr onto softc->rdwr_done. Only freed in sgread() after matching pack_id dequeued. Neither sgoninvalidate() nor sgcleanup() walks rdwr_done - comment literally says XXX Return all queued I/O with ENXIO and skips it. If process writes and never reads or device removed while I/O queued every queued rdwr leaks permanently. Compounding: sgread() that is past TAILQ_REMOVE and sleeping on rdwr (lock released) can race with sgcleanup() freeing softc: when sgread reacquires lock and does goto search TAILQ_FOREACH sc is freed memory - UAF.