XPT_RESET_DEV dereferences softc->atadev[tid] with no NULL or bounds check

Summary

atapi_action XPT_RESET_DEV case directly dereferences softc->atadev[ccb_h->target_id]->dev without NULL guard that XPT_PATH_INQ (:385) and XPT_SCSI_IO (:490) apply. If ATAPI device removed (atadev[tid]=NULL by reinit_bus) but CAM path not yet torn down CAM dispatches XPT_RESET_DEV causing NULL deref panic. No bounds check: atadev[] has 2 slots target_id can be CAM_TARGET_WILDCARD. Reachable via atacontrol reset or hot-plug race.