Divide-by-zero kernel panic from zero geometry in ad_attach/ad_describe

Summary

ad_get_geometry() copies heads/sectors straight from untrusted ATA IDENTIFY response with no lower-bound check. Malicious ATA device reporting heads=0 or sectors=0 causes ad_attach line 147 (adp->total_secs/(adp->heads*adp->sectors)) to execute kernel integer divide by zero x86 #DE panicking host during device attach. Same divisor reused in ad_describe :540 bootverbose path. ad_get_geometry sets adp->heads/sectors from param.heads/sectors (or current_heads/current_sectors) u_int16_t IDENTIFY words crafted device can set to 0. Neither path enforces heads>=1 or sectors>=1.