karc4random_buf charges only one run regardless of buffer length defeating keystream-limit reseed invariant

Summary

karc4random_buf() bumps d->arc4_numruns exactly once per call (arc4random.c:152) then emits len keystream bytes in tight loop (arc4random.c:156-157). Reseed-after-ARC4_MAXRUNS(16384) invariant defined in units of calls not bytes so single large-buffer request can pull unbounded run of RC4 keystream under one key. RC4 has documented keystream biases (FMS ABSAB byte-2 bias) that grow with keystream length the 16384-call cap exists to cap exposure this defect lets caller exceed it arbitrarily. No exploitable caller found every karc4random_buf caller passes compile-time-constant small length (pf.c:3664 pf_tcp_secret[16] wg_cookie.c wg_noise.c if_vtnet.c). None take attacker-controlled len. Latent invariant violation becomes exploitable (RC4 keystream distinguishing/partial-state recovery against long-lived keys) moment any future caller passes attacker-controlled length or security-critical secret refreshed via large karc4random_buf.