Missing payload length validation in sbp_recv1 allows stale/uninitialized heap data to drive control flow and leak to userspace

Summary

sbp_recv1 casts FireWire receive payload to struct sbp_status (32 bytes) and reads all fields without verifying actual bytes received >= sizeof(struct sbp_status). recv buffer allocated without M_ZERO. Malicious device sending short WREQB status block causes tail of sbp_status to contain stale data. Stale fields influence control flow (src resp dead len orb_lo) and copied to userspace via SCSI sense buffer.