Missing channel bounds check on card-reported channel in SCSI async event handler

Summary

isp_parse_async() SCSI variant reads channel number directly from OUTMAILBOX6 with no validation then uses it to index isp_param array via ISP_SET_SENDMARKER/SDPARAM. On dual-bus card value>=isp->isp_nchan yields OOB access unlike FC path which bounds-checks channel via GET_24XX_BUS. chan used unvalidated in ISP_SET_SENDMARKER(isp chan 1) and SDPARAM(isp chan). isp_param allocated exactly isp->isp_nchan=2 entries. Requires malfunctioning/compromised firmware or PCI-level fault not directly peer-controlled. Inconsistency with validated FC path GET_24XX_BUS guard.