SCSI CDB heap buffer overflow past orb[7] into ind_ptr on 16-byte CDBs

Summary

sbp_action1 copies SCSI CDB into SBP-2 ORB starting at orb[5] using csio->cdb_len as length but ORB only reserves 12 bytes (orb[5] through orb[7]). CAM_MAX_CDBLEN is 16 so any 16-byte SCSI command overflows 4 bytes past orb[7] into ind_ptr[0].hi. Via pass driver cdb_len up to 255 writing up to 243 bytes into ind_ptr page-table region DMA-coherent memory visible to FireWire device. Impact limited overflow stays within ind_ptr[128] array cannot reach sdev/flags/dmamap fields. For single-segment transfers ind_ptr unused corruption inert.