INQUIRY/READ_CAPACITY/page_inquiry dereference user-controlled data_ptr without CAM_DIR validation

Summary

ahci_xpt_scsi_disk_io() and ahci_xpt_page_inquiry() unconditionally dereference csio->data_ptr (as rdata) for write via bzero()/bcopy() in INQUIRY READ_CAPACITY VPD-page paths. Driver never checks (ccbh->flags & CAM_DIR_MASK) but cam_periph_mapmem skips allocation entirely when CAM_DIR_NONE set leaving csio->data_ptr as raw user-supplied value. Operator-privileged user can submit INQUIRY/READ_CAPACITY CCB with CAM_DIR_NONE and data_ptr=NULL (panic) or data_ptr=arbitrary kernel address (kernel writes zeros to that address).