CDB heap overflow via unchecked cdb_len into 12-byte CmdBlock

Summary

XPT_SCSI_IO driver copies pcsio->cdb_len bytes out of CDB into pSRB->CmdBlock with no check cdb_len fits. CmdBlock only 12 bytes (amd.h:159) immediately followed by union ccb *pccb (amd.h:160) but cdb_len attacker-controlled u_int8_t forwarded verbatim by passsendccb. 16-byte CDB (READ_16/WRITE_16 for >2TB disks) already overruns buffer. cdb_len>=17 corrupts pccb pointer. bcopy also reads cdb_len bytes from cdb_bytes[16] so cdb_len>16 is OOB read of adjacent ccb_scsiio fields. pccb dereferenced unconditionally (amd.c:287 amd.c:240 amd.c:919). amdsetupcommand feeds corrupted ScsiCmdLen to SCSI FIFO leaking overflowed bytes to target. Local /dev/passN CAMIOCOMMAND cdb_len>12.