isp_handle_platform_atio copies firmware CDB length into 16-byte cdb_bytes without bound (target-mode heap overflow)

Summary

In parallel-SCSI target-mode ATIO handler aep->at_cdblen (firmware-reported uint8_t may be up to ATIO_CDBLEN=26) used directly as memcpy length into atiop->cdb_io.cdb_bytes which is only IOCDBLEN=CAM_MAX_CDBLEN=16 bytes. CDB of 17..26 bytes from malicious SCSI initiator overflows cdb_bytes by 1..10 bytes into cdb_len/tag_action/sense_len/tag_id/init_id fields. FC paths correctly use fixed 16-byte lengths only legacy parallel-SCSI path unbounded. Requires kernel compiled with ISP_TARGET_MODE (off by default) and parallel-SCSI QLogic ISP adapter in target mode. Overwritten tag_id can confuse ATIO/CTIO bookkeeping potential command misrouting.