bhyve: validate corb->wp to avoid infinite loop
Guests must set HDAC_CORBWP less than corb->size. Treat invalid values
as an error rather than entering an infinite loop.
Reported by: Synacktiv
Reviewed by: markj
Security: HYP-12
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46134
(cherry picked from commit a305f44d1404fbf386bb2b50ab7233ce9eabe0bb)