Negative hw.ioapic.msi_start loader tunable causes OOB array index in MSI allocation

Summary

ioapic_abi_msi_start at ioapic_abi.c:753 kgetenv_int (strtoq accepts negative). :754 &= ~0x1f: for signed int ~0x1f=-32, so (-64)&(-32)=-64 stays negative. :1269 for(i=msi_start;i<IOAPIC_HWI_VECTORS;i+=count) -> i negative -> ioapic_irqmaps[cpuid][i] OOB read at :1272 and OOB write at :1287-1295 + bogus intrs[] at :1295. Exhaustively verified: 0 OOB for non-negative aligned; 1152 OOB per CPU for negative. Root-only (loader.conf or kenv(2)). Source comment :555 flags knob as testing-only. Self-DoS: panic/corruption on next PCI MSI alloc. Fix: if(msi_start<0||msi_start>=IOAPIC_HWI_VECTORS) msi_start=0.