NULL-pointer dereference in ahci_pm_read/ahci_pm_write when CCB pool is exhausted

Summary

ahci_pm_read() and ahci_pm_write() call ahci_ata_get_xfer() and immediately dereference returned ata_xfer pointer without checking for NULL. ahci_ata_get_xfer() returns NULL when per-port CCB free list empty. xa->fis is first field of struct ata_xfer so NULL xa causes fault reading *(0x0) on very next line panicking kernel. Reachable from PM hot-plug/async-notify handling when port CCB pool saturated by concurrent NCQ I/O. ahci_pm.c:976 xa=ahci_ata_get_xfer(ap ap->ap_ata[15]) then :978 xa->fis->type=ATA_FIS_TYPE_H2D with no NULL check. Same defect at :1013/:1015 ahci_pm_write. Pool is sc_ncmds-deep minus error-CCB slot so under heavy NCQ I/O on PM-backed port all slots can be in flight when hot-plug event arrives. Attacker: malicious SATA PM spamming async-notify + local user keeping CCB pool saturated with I/O.