Sign error in netmap_grab_packets: computes cur+reserved instead of cur-reserved, forwarding wrong slots to host stack

Summary

netmap_grab_packets(:736-741) comment says "compute the final position, ring->cur - ring->reserved" but code does k += n(:740) i.e. ADDS reserved instead of subtracting. Correct modular subtraction exists at netmap_rxsync_from_host(:914) k=(k>=resvd)?k-resvd:k+lim-resvd. Result: wrong range of slots forwarded to/from host stack via NIOCTXSYNC/poll host-ring path. Memory accesses stay bounded (nm_next wraps at lim, slot->len validated :748, BDG_NMB falls back to buf 0) so no OOB — wrong-packet delivery only. Device 0660 root:wheel.