SET_TICKS computes len*8*dn_hz in int: overflow for jumbo packets at high dn_hz -> shaper bypass

Summary

SET_TICKS(:431-433) and ready_event(:483)/ready_event_wfq(:549): len*8*dn_hz computed as signed int32. At dn_hz=10000 a 65535-byte packet -> 5.24e9 > INT_MAX -> wraps negative. Negative len_scaled in ready_event: q->numbytes-=len_scaled (u_long) adds huge credit -> queue drains far beyond configured bandwidth -> shaper bypass. Limited real-world: needs high dn_hz + jumbo.