Unbounded ccb_index from firmware LRAM into ccb_infos[] heap OOB read + attacker-influenced pointer deref

Summary

adv_run_doneq looks up completed CCB by indexing adv->ccb_infos[scsiq.d2.ccb_index] where ccb_index is u_int32_t read straight from firmware LRAM. No bounds check against max_openings (ccb_infos array size). Corrupted/maliciously-crafted ccb_index reads OOB struct adv_ccb_info from kernel heap and immediately dereferences its ->ccb pointer and writes to it turning OOB read into kernel panic or with heap grooming memory-corruption primitive. Driver originally writes cinfo-adv->ccb_infos into that LRAM field when submitting but trusts value blindly on read-back. Same unbounded pattern recurs in advlib.c:1988 (adv_abort_ccb). cur_active decrement also unguarded #ifdef DIAGNOSTIC only.