Unbounded tuple.ptr from attacker-controlled longlink/MFC addresses drives bus_space_read out of the mapped CIS window

Summary

In pccard_scan_cis the 32-bit CIS link-target addresses CISTPL_LONGLINK_A/C (read into longlink_addr at :212) and per-function MFC addresses (read into mfc[].addr at :334) are copied directly into tuple.ptr (:394 :406) then dereferenced via pccard_cis_read_1/pccard_tuple_read_1 (:413 :419 :425-427) with NO bounds check. Only bounds check in function (:164) lives inside inner tuple-read loop and is structurally bypassed by separate link-chain traversal loop at :386-437 which reads at attacker-supplied address before control returns to bounded inner loop. Mapped resource is PCCARD_CIS_SIZE=4096 bytes. Any ptr with mult*ptr>=4096 is out-of-window access. On PCI/CardBus MMIO this is master abort (panic or 0xFF) on ISA may hang the bus if mapping abuts other MMIO can read adjacent device/kernel memory.