Memory leak of targ_cmd_descr in targread abort_queue drain loop

Summary

When targread() drains abort_queue each targ_cmd_descr is TAILQ_REMOVEd and its user_ccb delivered to caller but descr itself never kfreed. descr allocated by targgetdescr (kmalloc) moved to abort_queue by targstart on send failure or abort_all_pending. Every aborted-then-read descriptor (~80 bytes) permanently leaked. Parallel user_ccb_queue drain path correctly frees via targreturnccb->targfreeccb (kfree at 1012) and targdtor frees remaining abort_queue entries at teardown (547). A RESTRICTEDROOT user can drive this leak unboundedly by submitting CCBs that deterministically fail (dxfer_len>MAXPHYS) then reading them back exhausting kernel memory.