DF-3584 — Unvalidated target index into fcp->isp_dev_map[] in isp_control() (far OOB read)

WHAT sys/dev/disk/isp/isp.c:4522 (ISPCTL_RESET_DEV) and 4624 (ISPCTL_ABORT_CMD), inside isp_control():

    hdlidx = fcp->isp_dev_map[tgt] - 1;
    if (hdlidx < 0 || hdlidx >= MAX_FC_TARG) { ... }

The RESULT of the array load is bounds-checked, but `tgt` — the INDEX —
is never validated against MAX_FC_TARG (contrast isp_start(),
isp.c:4247-4254, which checks XS_TGT before the same array).

The CAM glue makes it worse: XPT_RESET_DEV packs the bus number into the
same word (isp_freebsd.c:4519-4523):

    bus = cam_sim_bus(xpt_path_sim(ccb->ccb_h.path));
    tgt = ccb->ccb_h.target_id;
    tgt |= (bus << 16);
    error = isp_control(isp, ISPCTL_RESET_DEV, bus, tgt);

so for a device on channel 1 the 24XX path reads
    offsetof(fcparam, isp_dev_map) + 2*(65536 + target_id)
  = 20536 + 131072 = >=151608 bytes into an allocation of
    nchan*sizeof(fcparam) (21576 or 43152 bytes)
— >= 108 KB past the end: a wild kernel read on EVERY BDR issued to a
channel>0 device (panic if the page is unmapped; garbage index otherwise,
which the post-check then mostly rejects).

REACHABILITY Any XPT_RESET_DEV reaching the driver for a channel>0 FC device: cam_periph error recovery (a hung/errored disk on port B of a dual-port 24xx/25xx, NPIV/multi-ID configurations), or camcontrol reset issued by an operator-group user via the pass(4) node. The read is deterministic; whether it faults depends on what follows the allocation in kmem.

PROOF (this pack) trigger_df3584.c performs the identical isp_dev_map[tgt] load with tgt = 0x10000 (bus 1, target 0) against a 43152-byte (2-channel) fcparam-sized allocation followed by PROT_NONE:

    read address = base + 20536 + 2*65536 = base + 151608
    => 108456 bytes past the end of the 43152-byte allocation
    FAULT (SIGSEGV/SEGV) at 0x8004c5038 => 108456 bytes past allocation end

WHY "inconclusive" No QLogic HBA (and in particular no multi-channel 24xx) in the guest, so the in-kernel path cannot be exercised. Offsets proven with the real kernel headers on the guest compiler.

FIX fix.diff — validate tgt before indexing (both ISPCTL_RESET_DEV and ISPCTL_ABORT_CMD), mirroring isp_start()'s check. (The tgt |= bus<<16 packing in isp_freebsd.c should also be dropped by whoever owns that file; the isp.c-side validation makes the core robust regardless.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.