uint32 wraparound in table_lba+table_blocks location bounds-check

Summary

table_lba+table_blocks computed in uint32 before promotion to uint64 for comparison(:139). Near-UINT32_MAX values wrap -> bounds check bypassed. Read at out-of-range offset -> EIO mount failure. DoS only, no kernel memory OOB. Same pattern at :211 lower-bound test.