xio_init_pages accepts negative npages; only upper bound asserted

Summary

xio_init_pages(:147) KKASSERT(npages<=XIO_INTERNAL_PAGES) only. Negative npages stored in xio_npages(:153), xio_bytes=npages*PAGE_SIZE negative(:151). Latent state corruption, no callers pass negative today.