scmmap under-bounds offset when framebuffer height*stride is 0 or overflows int

Summary

scmmap at syscons.c:4090-4097: sz=roundup(fbi->height*fbi->stride,PAGE_SIZE). height/stride uint16; product computed as int (overflows 65535*65535). If height or stride=0: sz=0, sz-PAGE_SIZE underflows to ~2^64-4096, any offset passes bound -> vtophys(vaddr+offset) maps unintended physical memory. Requires SYSCAP_RESTRICTEDROOT + buggy/malicious framebuffer driver. Fix: reject height==0||stride==0, compute in size_t, check sz>=PAGE_SIZE before subtraction.