Unchecked queue argument -> OOB write on wc_blocked[queue]

Summary

sleepq_add(:266) ++wc_blocked[queue] with no bounds check on queue vs SLEEPQ_NRQUEUES(=2). wc_blocked is last field of struct, so queue>=2 or negative writes past heap object. Also stored in td->td_sqqueue(:284), reused by _sleepq_wait_complete(:354). Dead code (no callers).