Drive-controlled / TOCTOU OOB kernel heap read in DVD_STRUCT_BCA and DVD_STRUCT_MANUFACT

Summary

In acd_read_structure DVD_STRUCT_BCA and DVD_STRUCT_MANUFACT cases use s->length=ntohs(d->length) as bcopy length where d->length is drive-controlled u_int16_t then re-read s->length from user pointer in bcopy. Neither value bounded against actual size of kernel buffer d (188 bytes BCA 2048 bytes MANUFACT). Malicious ATAPI device or user racing s->length causes bcopy to read up to 65535 bytes past d allocation into adjacent kernel heap written to user memory.