FW_SBINDADDR / FW_CBINDADDR NULL-pointer dereference when receive xferq is uninitialized (local DoS)

Summary

fw_ioctl unconditionally dereferences ir (d->ir) inside FW_SBINDADDR and FW_CBINDADDR even though ir is NULL until FW_SRSTREAM has been issued. Opening /dev/fw0.0 and immediately calling FW_SBINDADDR dereferences address ~offsetof(fw_xferq dmach) panicking kernel. FW_CBINDADDR same flaw on &ir->binds. Local operator-group user single-open single-ioctl kernel panic. No FireWire bus activity required.