TOCTOU in i_create_session: sc->sessions[n] assigned outside the search lock

Summary

i_create_session() searches for lowest unused session slot under sc->lock then writes sc->sessions[n]=sp AFTER releasing lock. Two concurrent ISCSISETSES callers can both observe same slot n as free both insert into sc->isc_sess both bump nsess both attempt make_dev(n) for same minor. Result: leaked/orphaned session and make_dev collision on duplicate minor. sc->sessions/isc_sess/TAILQ/nsess bookkeeping inconsistent. make_dev on duplicate minor can fail caller gets half-built session sp->dev==NULL subsequent NULL deref in ism_stop destroy_dev(dev). Root only.