rman_reserve_resource has no count==0 guard - unsigned underflow in range math corrupts resource list

Summary

rman_reserve_resource (subr_rman.c:224/250/279): start+count-1 when count==0 -> count-1 wraps ULONG_MAX -> start+ULONG_MAX wraps. :279 rv->r_end=rstart+count-1=rstart-1 -> r_end<r_start corrupted node inserted TAILQ (:308-326) violating sorted-by-r_end invariant -> subsequent alloc infinite loop/incorrect match/further corruption. :254 (rend-rstart+1)>=count always true for count==0 so allocation proceeds. count from ACPI _CRS (acpi.c:1146) or driver resource list (nexus.c:369) firmware-controlled. Speculative: no known in-tree caller passes count==0. Fix: if(count==0) goto out (return NULL).