ffs_reallocblks(): ensure that pref cg is valid

[kib]

Summary

ffs_blkpref_ufsX() must return in-range pref frag number, otherwise
calculated cg index is out of range for fs, causing out of range
accesses to the structures sized by the number of cg, e.g. the
fs_maxcluster[] array in ffs_clusteralloc().

The easiest way to trigger it is to overflow the volume.

ffs_blkpref_ufsX(): do not iterate over startcg twice

[mckusick]

These changes look correct to me. I am surprised that it has taken this long to trip over this error case.