dagetcapacity() parses READ CAPACITY results from a non-zeroed heap buffer; short transfer with good status publishes stale kernel heap as disk geometry and prints it to console/dmesg

Summary

Open-time reprobe allocs the combined rcap/rcaplong buffer with plain M_INTWAIT (unlike the attach-probe's M_ZERO) and re-uses it between the 10/16-byte commands; CAM_REQ_CMP with resid>0 (virtio-scsi/umass propagate device resid) parses never-written bytes: stale M_SCSIDA heap (shared across all da units - cross-device disclosure) becomes secsize/sectors, printed verbatim to dmesg for removable media and exposed via GETGEOM, and can feed the DF-2274 secsize==0 divisor family from an unvalidated source. M_ZERO + resid-reject fix.