Fix an integer overflow in computing the size of a temporary buffer

Fix an integer overflow in computing the size of a temporary buffer
can result in a buffer which is too small for the requested
operation. [13:09]

Fix a bug that could lead to kernel memory disclosure with
SCTP state cookie. [13:10]

Fix a data corruption problem with mfi(4) operating on > 2TB
disks in a JBOD. [EN-13:03]

Security:	CVE-2013-3077
Security:	FreeBSD-SA-13:09.ip_multicast
Security:	CVE-2013-5209
Security:	FreeBSD-SA-13:10.sctp
Approved by:	so

git-svn-id: svn://svn.freebsd.org/base/releng/9.1@254631 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f