bhyve: validate corb->wp to avoid infinite loop

Guests must set HDAC_CORBWP less than corb->size. Treat invalid values
as an error rather than entering an infinite loop.

Reported by: Synacktiv
Reviewed by: markj
Security: HYP-12
Security: FreeBSD-SA-24:17.bhyve
Approved by: so
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46134

(cherry picked from commit a305f44d1404fbf386bb2b50ab7233ce9eabe0bb)
(cherry picked from commit 6a645bb3535cb73b1f20db652c9e3893f26a986e)
(cherry picked from commit 867aaad5c2bfdd8326fc805964e711ccfbb18d1e)