Timeout conversion uses 32-bit int arithmetic that can overflow

Summary

kern_umtx.c:188-192 timeout conversion in int. (timeout%1000000)*hz+999999 overflows for hz>=2148 or large umtx_timeout_max. Root-set sysctl or non-default hz. Self-DoS only.