Negative qsize bypasses queue-size limit via signed/unsigned comparison: unbounded mbuf accumulation / OOM

Summary

set_fs_parms(:1437-1443) clamps qsize high side only (1MiB bytes / 100 slots), never rejects negatives. qsize=-1 stored as int. dummynet_io: q->len_bytes(u_int)>fs->qsize(int) promotes negative to UINT_MAX -> drop condition never satisfied -> unbounded queue growth -> kernel OOM/panic.