Heap OOB read in PREQ processing when target count is 0: (ndest-1) wraps to SIZE_MAX

Summary

verify_mesh_preq_len(:311) accepts ndest==0. Alloc sizeof(*preq)+(ndest-1)*sizeof(target) -> (0-1)=SIZE_MAX*sizeof(target) wraps to tiny alloc ~34 bytes. hwmp_recv_preq(:1005) unconditionally derefs preq_targets[0] (offset 34-44, 11 bytes past alloc). Remote: mesh peer sends PREQ with target count 0. Heap OOB read ~11 bytes adjacent slab -> info leak/route corruption.