FreeBSD 11.4 sys_pipe2 copies the descriptors out after kern_pipe and, if
that fails, closes both and returns EFAULT (sys/kern/sys_pipe.c:479-483).
pipe checked the array with HostWrite::Open, which accepts any non-arena
host pointer, and wrote it with memcpy, so a pointer into unmapped memory
crashed the host. Copy out with the checked write and close both
descriptors on failure.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
