Missing bounds check on ivlen in cryptoapi_cipher_encrypt/decrypt (latent stack buffer overflow)

Summary

cryptoapi_cipher_encrypt/decrypt at cryptoapi.c:1124/1143: stack-local cryptoapi_cipher_iv iv2 (16 bytes, CRYPTOAPI_MAX_IV_LEN=16) then memcpy(iv2, iv, ivlen) with NO bounds check on ivlen (int). ivlen>16 -> stack overflow; ivlen<0 -> huge size_t OOB read. Sole consumer dm_target_crypt passes sizeof(cryptoapi_cipher_iv)=16 always (dm_target_crypt.c:361,980) and dm-table ioctl requires privilege. cryptoapi_cipher_newsession validates cipher->ivsize<=16 at session creation but NOT runtime ivlen arg. Public API in cryptoapi.h:78-86 with no documented upper bound. Fix: if (ivlen<0 || ivlen>(int)sizeof(iv2)) return EINVAL.