old_dev_pager_ctor truncates page count to unsigned int, skipping validation for huge sizes

Summary

old_dev_pager_ctor at device_pager.c:316 declares unsigned int npages. Line 328 npages = OFF_TO_IDX(size) truncates 64-bit vm_pindex_t to 32 bits -> sizes >16 TiB lose high bits. Per-page validation loop at :329 iterates only truncated count, validating only first ~16 TiB of requested range. vm_map_entry covers full size -> pages beyond ctor validation can be faulted. Per-fault dev_dmmap still gates each page so no direct exploit. Worst case: buggy driver relying on ctor upfront scan to reject out-of-range mapping would let it be created and only SIGSEGV at fault time (self-DoS). Fix: vm_pindex_t npages.