Silent 64→32-bit mb_lba truncation with a print-only beyond-EOF check in amr_bio_command — unchecked raw-disk I/O past 2TiB wraps to an attacker-chosen in-range LBA (firmware is the only backstop)

Summary

The 64-bit offset quotient is assigned into u_int32 mb_lba and the only bounds check device_printfs and submits anyway - a raw write at >=2TiB wraps to LBA 0 if the firmware accepts it. Root:operator only; data-integrity class. Fail-the-bio fix.