Kernel pointer leak via targreturnccb copyout of ccb_hdr.cbfcnp and ccb_hdr.path

Summary

targreturnccb() copies [retry_count periph_priv) slice of ccb_hdr back to user-supplied CCB without sanitizing kernel-only fields cbfcnp and path. cbfcnp unconditionally set to kernel text address &targdone (targsendccb:769 targgetccb:1001) and path set to kernel heap pointer softc->path by xpt_setup_ccb. Both fields inside copied range so every read()/inline-write path leaks kernel function pointer and kernel heap pointer defeating KASLR. Sibling scsi_pass.c:610 explicitly NULLs cbfcnp before copyout; scsi_target.c does not. RESTRICTEDROOT gate (delegatable to non-root subjects). No integrity/availability impact by itself but turns any separate kernel bug from unexploitable to exploitable.