cdgetccb() stores its result in a function-static 'union ccb *' — concurrent callers on different SIM locks can receive the same ccb (double xpt_release_ccb) or leak one

Summary

Function-static scratch shared across all instances and SIM locks: two CD devices on different HBAs issuing commands concurrently can both receive the same ccb pointer -> double xpt_release_ccb (CCB zone double-free/UAF family) while the other leaks. cam_periph_getccb itself sleeps, widening interleavings. Tiny window, hard to hit deliberately. Pre-ANSI heritage 'static'. Make-it-a-local fix.