Signed int len assigned from u_int32_t dxfer_len signedness overflow in INQUIRY bzero and odd-length kmalloc/bcopy

Summary

atapi_action declares int len and assigns len=csio->dxfer_len (u_int32_t). For dxfer_len>INT_MAX len becomes negative. INQUIRY special-case bzero(buf len) sign-extends to huge size_t catastrophic overwrite. Odd-length READ path kmalloc(++len) wraps to 0 completion bcopy uses original huge value against tiny kmalloc(0) slab slot massive OOB read. CDB length check at :509 only bounds cdb_len never dxfer_len.