Wait-counter inc/dec can overflow into control bits (theoretical)

Summary

Wait counter bits 0-29. atomic_intr_cond_inc/dec are plain incl/decl on full word. ~1.07e9 waiters -> carry into bit 30 (handler-disabled) or 31 (lock-held). Not achievable: max CPUs 256, each contributes 1 outstanding inc.