Missing validation of queue length in NGM_UBT_NODE_SET_QLEN: negative qlen -> uint32 wrap to 0xFFFFFFFF unbounded queuing

Summary

ng_ubt_rcvmsg NGM_UBT_NODE_SET_QLEN(:1625-1654): qlen(int32_t from user) assigned directly to q->maxlen(uint32_t) at :1653 with no bounds check. qlen=-1 -> maxlen=0xFFFFFFFF -> NG_BT_MBUFQ_FULL len>=0xFFFFFFFF effectively disabled -> unbounded mbuf queuing -> kernel OOM DoS. qlen=0 -> maxlen=0 -> queue permanently blocked. Should validate qlen>0 && qlen<=reasonable_max.