flen (char)   imin result   stored .len (u_char)
0                       0                      0
1                       1                      1
5                       5                      5
15                     15                     15
16                     16                     16
17                     16                     16
-2                     -2                    254
-1                     -1                    255
-1                     -1                    255
-2                     -2                    254
-128                 -128                    128

Bad case flen=-1:
  imin(-1, 16)        = -1
  stored entry.len    = 255 (wraps via u_char)
  bcopy length        = 255
  source keydef OOB   = 239 bytes (leaks user-side stack/heap)
  dest str OOB        = 239 bytes (overwrites adjacent fkeytab / kobj heap)

CONFIRMED: SETFKEY with flen=-1 (or any negative char) yields entry.len=255 and bcopy(255) into 16-byte arrays -> 239-byte OOB heap/static write. atkbd uses static default_fkeytab[96] (.bss corruption); kbdmux/ukbd/vkbd use kmalloc (heap corruption). Trigger: open /dev/kbdN (root + RESTRICTEDROOT pass) and SETFKEY.
RUN_EXIT=0