INQUIRY EVPD response fabrication writes to CCB data buffer without validating dxfer_len

Summary

When INQUIRY EVPD targets SVPD_UNIT_SERIAL_NUMBER (0x80) on umass device with USB iSerialNumber umass_cam_action fabricates VPD response by writing directly into ccb->csio.data_ptr without verifying buffer (ccb->csio.dxfer_len bytes) large enough for struct scsi_vpd_unit_serial_number (255 bytes). memcpy(vpd_serial->serial_num pserial vpd_serial->length) writes up to 251 bytes at offset 4 so any dxfer_len<4+strlen(pserial) overflowed. Path 2: umass_cam_cb appends SVPD_UNIT_SERIAL_NUMBER to device-supplied SVPD_SUPPORTED_PAGE_LIST using device-controlled page_list->length as write index validating only against struct field (251) not actual CCB buffer size. Malicious device returning length=(dxfer_len-4) forces 1-byte heap overflow. strlen->uint8->251 clamp only bounds to struct field never to caller buffer. [VERIFIED pass2: reproduced against canary-banded CCBs - serial path writes 31 and 96 bytes past dxfer_len 8, page-list writes at offset 204 into a 68-byte buffer via device length byte; dxfer_len clamp fix-validated sentinels intact]