Heap OOB read+write via unbounded sense_len in autosense bcopy

Summary

On SCSI_STATUS_CHECK_COND/CMD_TERMINATED completion adw_intr() copies autosense data with bcopy(&acb->sense_data &ccb->csio.sense_data ccb->csio.sense_len). sense_len is attacker-influenced u_int8_t (range 0..255) copied verbatim from userland by xpt_merge_ccb via pass(4) and in-kernel storage on both ends only 32 bytes (SSD_FULL_SIZE). sense_len bounded to sizeof(acb->sense_data) when told to firmware (:384) but NOT when copying back out. sense_len of 255 reads 223 bytes past acb->sense_data into adjacent acb fields (kernel heap pointers) and writes them past ccb->csio.sense_data into adjacent csio fields. Info-leak primitive ~200 bytes per call KASLR-bypass-grade kernel heap info leak. mpt SIM bounds this same op with min().