Unclamped cdb_len over-reads 16-byte inline cdb_bytes and leaks kernel memory out parallel port

Summary

vpo_intr passes csio->cdb_len (u_int8_t 0..255) directly as command length to imm_do_scsi/vpoio_do_scsi while handing &csio->cdb_io.cdb_bytes as command buffer but cdb_bytes is fixed 16-byte IOCDBLEN inline array. cdb_len>16 makes send loop read past cdb_bytes into rest of csio/ccb (cdb_ptr/msg_ptr kernel pointer aliases) and transmit bytes out parallel-port SCSI bus. Leaked bytes include kernel pointer material from csio struct KASLR disclosure to physical/hardware channel. csio->cdb_len caller-controlled unvalidated via xpt_merge_ccb. Local privileged attacker root/operator.