Unclamped sense_len overflows 32-byte inline sense_data buffer on CHECK CONDITION

Summary

On SCSI CHECK CONDITION vpo_intr issues REQUEST_SENSE using csio->sense_len (u_int8_t 0..255) as byte-transfer bound and &csio->sense_data as destination but csio->sense_data is fixed 32-byte struct scsi_sense_data. Low-level loops write up to blen bytes into buffer. sense_len>32 overflows sense_data into adjacent csio fields (cdb_len sglist_cnt scsi_status sense_resid resid cdb_io msg_ptr). csio->sense_len reachable at arbitrary value via CAM pass-through xpt_merge_ccb copies wholesale no validation. Local privileged attacker root/operator /dev/passN. Bounded CCB corruption not arbitrary write.