tcp_mtudisc accepts forged ICMP MTU small enough to drive t_maxseg negative

Summary

tcp_get_inpnotify(:1448) passes raw ICMP nextmtu to tcp_mtudisc. mtu<sizeof(tcpiphdr)(40) -> maxopd=mtu-40 negative(:1820). Early-out t_maxopd<=maxopd compares positive vs negative, does NOT bail. t_maxseg stored negative(:1871). tcp_minmss exists(:169) but never consulted. On-path attacker: forged ICMP type 3 code 4 with nextmtu=1 + valid seq -> corrupted connection.