crom_parse_text bounds check missing sizeof(u_int32_t) multiplier allows OOB heap read past ROM buffer

Summary

crom_parse_text checks (vm_offset_t)textleaf + textleaf->crc_len > CROM_END(cc) but crc_len is quadlet count not byte count - check missing * sizeof(u_int32_t) factor and is 4x too permissive. Text leaf near buffer end passes check but text data reads up to hundreds of bytes past ROM buffer leaking kernel heap into user-visible SCSI inquiry strings. For leaf at buffer+1000 with crc_len=10: check passes (1000+10=1010<=1023) but textleaf->text[0..7] reads buffer+1012 through buffer+1043 up to 19 bytes past buffer. Works even with default info_len=4.