bhyve: validate corb->wp to avoid infinite loop

Guests must set HDAC_CORBWP less than corb->size. Treat invalid values
as an error rather than entering an infinite loop.

Reported by: Synacktiv
Reviewed by: markj
Security: HYP-12
Sponsored by: The Alpha-Omega Project
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D46134