Set target->sbp field to valid value when sbp device is created.

The sbp_cam_detach_target can be called from sbp_post_explore function
on the first target that is not really attached and it was written with
the corresponding safety check in place to tolerate that. Unfortunately
the recent locking cleanup did add a locking assertion that tries to
dereference the target->sbp pointer unconditionally, which causes less
than desirable outcome. Since the assertion is useful, just initialize
the target sbp pointer once when sbp device is being initialized instead
of when the target is being attached. This makes assertion work in all
cases and fixes the crash on boot.
Remove an unnecessary kick of the host at the end of transmitting

MFC after:	1 week
Handle multiple calls to rxq_eof for single packet completion

This requires the VMware vmxnet3 device to flip the start of packet
descriptor's generation before the rest of the packet's descriptors
have been loaded into the Rx ring. I've never observed this behavior,
and it seems to make the most sense not to do it this way. But it is
not a lot of work for the driver to handle this situation just in case.

MFC after:	1 week
Increment the pending packets more aggressively for TSO

Assume the number of description used is reasonable value to
increment this otherwise opaque field by.

While here, reduce a minor difference between the legacy and
multiqueue transmit paths.

MFC after:	1 week
Assert that the new entry is inserted into the right location in the
map entries list, and that it does not overlap with the previous and
next entries.

Reviewed by:	alc
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Merge remote-tracking branch 'freebsd/master' into hardened/current/aslr