TOCTOU on CCDF_INITED allows concurrent CCDIOCSET to leak memory and vnodes

Summary

if(cs->sc_flags & CCDF_INITED) return(EBUSY) guard in CCDIOCSET evaluated BEFORE ccdlock acquired and never re-checked under lock. Two threads both observe CCDF_INITED==0 before either takes lock both proceed second runs ccdinit and overwrites cs->sc_cinfo cs->sc_itable ccddevs[unit].ccd_cpp/ccd_vpp without freeing first configuration allocations first config component vnodes never vn_closed. Repeated racing exhausts kernel heap and/or vnode table. ccdstrategy INITED read at :797 also lockless vs CCDIOCCLR free at :1464-1467 residual UAF though dev_drefs(cs->sc_dev)>1 at :1434 usually blocks.