ncr(4): CCB-supplied target_id/target_lun index per-adapter arrays without bounds checks in ncr_action/ncr_get_nccb (and CDB/sense length fields are trusted for DMA sizing) — hardening against privileged CAM injection

Summary

ncr_action() indexes np->target[ccb->ccb_h.target_id] and tp->lp[target_lun], and ncr_get_nccb() reads np->target[target].lp[lun] before any bounds check - the only checks live in ncr_alloc_nccb which runs after the OOB read. The XPT core does not validate path target/lun against the SIM's advertised max_target/max_lun (xpt_compile_path creates arbitrary device edges), so a CCB routed down a path created with lun>7 or target>15 reads out of bounds and chases a wild lp pointer. Similarly cp->phys.cmd.addr/size are built from cdb_len/sense_len without clamping: a privileged pass(4) CCB with cdb_len>16 makes the chip DMA past the inline CCB fields. Unprivileged-reachable paths stay in bounds (bus scan iterates 0..max; /dev/pass*/xpt0 root-only) - defense-in-depth, not a privilege boundary. Same shape in sym_hipd's sym_get_ccb.