Out-of-bounds array access in amd_Reselect when reselecting-ID byte decodes to no valid target

Summary

amd_Reselect decodes reselecting-target ID from SCSI FIFO as ffs(xored)-1 with no check ffs() returned non-zero. If target drives reselection byte that XORs with HostID_Bit to zero ffs() returns 0 cur_target becomes -1 subsequent tinfo[] untagged_srbs[][] disc_count[][] accesses including write index out of bounds in amd_softc. cur_target=-1 accesses disc_count[-1][lun] overlap tail of tinfo[] sync_period_reg/offset/disc_tag bytes. Multi-bit garbage byte decodes via ffs to wrong-but-in-range target ID producing confused-deputy. Attacker: malicious SCSI target device drives HostID_Bit during reselection. Impact: kernel memory corruption wild active_srb pointer panic or exploitable.