Unbounded attacker-controlled buffer offset (bo) in so_recv douio path - latent OOB write + latent stack overflow same defect class as scsi_decap DF-2458

Summary

When sp->douio enabled and ISCSI_READ_DATA PDU arrives so_recv computes receive destination as csio->data_ptr+ntohl(rcmd->bo) where rcmd->bo is target-supplied Buffer Offset guarded only by ntohl(cmd->edtlen)>=pq->pdu.ds_len. Check bounds length NOT offset so malicious target/MITM can choose arbitrary 32-bit bo and direct ds_len-byte write anywhere within ~4GiB of csio->data_ptr. Second iovec points at 4-byte stack local int r with iov_len=len-ds_len potentially megabytes stack overflow. Currently LATENT: so_pru_soreceive called with uio=NULL at :480 receives into sockbuf sbp instead prepared iov never consumed. Matching scsi_decap instance DF-2458 IS live today. Must fix bounds before obvious wiring done.