Unbounded queue-number index into sense_buffers[] heap OOB read / kernel heap info leak

Summary

adv_done indexes adv->sense_buffers[q_no-1] using queue number read directly from firmware LRAM via adv_copy_lram_doneq with no validation q_no in [1 max_openings]. sense_buffers allocated for exactly max_openings entries. q_no of 0 (underflows to 0xFFFFFFFF since u_int) or q_no > max_openings (firmware queue space extends ADV_MAX_QNO=0xF8=248 while max_openings may be 16) causes OOB heap read structure-copied into CCB auto-sense buffer returned to userland via CAM_AUTOSNS_VALID. Impact: kernel heap memory disclosure up to few KB per request when q_no > max_openings or immediate panic when q_no==0. Requires control of AdvanSys HBA LRAM.