rt_fixchange indexes mask bytes by key length without verifying mask size: latent OOB read

Summary

rt_fixchange(:1130-1165): mlen=rt_key(rt->rt_parent)->sa_len then iterates xmp[i],xm1[i] indexed by key length. Guard only checks mlen<=rt_key(rt0)->sa_len, NOT rt_mask->sa_len. If mask sa_len < key sa_len -> OOB read. Currently not triggerable (radix allocates masks key-sized). Latent if mask/key sizing invariant relaxes.