NULL pointer dereference of xa when ahci_ata_get_xfer() returns NULL

Summary

ahci_xpt_scsi_disk_io() and ahci_xpt_scsi_atapi_io() obtain ata_xfer with xa=ahci_ata_get_xfer(ap atx) but never check return for NULL. ahci_ata_get_xfer returns NULL when per-port CCB free list (ap_ccb_free) empty. Every subsequent deref (xa->fis xa->complete xa->atascsi_private xa->tag xa->flags ahci_ata_put_xfer) NULL deref panics kernel. CAM devq throttle does not strictly guarantee free ahci slot available particularly after NCQ-slot-pruning loop in ahci_cam_probe permanently removes slots from free list when device ncqdepth < sc_ncmds. Local DoS reachable by any user issuing disk I/O against AHCI-attached SATA disk with ncqdepth < sc_ncmds.