daioctl(DAIOCTRIM) reads its 16-byte argument by direct user-pointer dereference with no copyin: kernel page fault (panic) on unmapped user pointer and user-memory race across the synchronous loop

Summary

ap->a_data cast to off_t* and dereferenced raw: an unmapped pointer faults the kernel at the del_num[1] load (panic), and no copyin snapshot exists - the same sloppiness family as DF-1019/2275/2276 but the missing copyin itself is distinct. Root-gated (RESTRICTEDROOT). copyin-then-validate fix (also unblocks real EINVAL checks).