Missing cdb_len validation in DISK I/O path allows OOB read on short CDB pointer

Summary

ahci_xpt_scsi_disk_io() computes CDB pointer from csio->cdb_io.cdb_ptr when CAM_CDB_POINTER set and accesses CDB structures up to 16 bytes wide (cdb->read_capacity_16 cdb->ata_pass_12 cdb->ata_pass_16 cdb->rw_10/12/16) without ever consulting csio->cdb_len. ATAPI sibling path correctly bounds this with cdb_len<6||cdb_len>16 check but DISK path does not. User-supplied CCB via /dev/pass with CAM_CDB_POINTER and cdb_len<16 causes kernel to read past user-supplied CDB buffer. SMAP faults kernel panic. With kernel-address cdb_ptr (requires KASLR bypass) 14 bytes kernel memory read into FIS fields.