[dfed kernel #8 02:38:40, dfx-built2, same trigger in=out=0x80000000]
dfh: DF2248: TRIGGER in=out=0x80000000 (bit 31 set -> int r negative -> while(r--) runaway)

Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xfffff801167bf000
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff809da56e   (iconv_xlat_conv, the *dst++ = d_table[*src++] store)
kernel: type 12 trap, code=2

NOTE: with the szmin/size_t fix the counters are no longer truncated to a
negative int, but the KPI still honours the caller-supplied 0x80000000
byte counts (same caller-trust contract as iconv_xlat16_conv upstream),
so the lying-counter trigger still overruns.  The sign/truncation defect
itself is proven eliminated by the mode-2 probe semantics change (see
VERDICT.md).