sysctl_kcollect_data copies past user buffer (unsigned underflow in bounds check)

Summary

After 2 header records, error not checked before data loop(:235-245). Loop guard oldlen-oldidx<sizeof (size_t underflow when oldidx>oldlen) -> never breaks. SYSCTL_OUT writes full 256-byte records past buffer. Caller-owned memory corrupted. No kernel mem-safety violation. Unpriv.