Infinite loop / negative b_bcount in DAIOCTRIM from negative user-supplied length

Summary

daioctl(DAIOCTRIM) reads bytes_left bytes_start as signed off_t only enforces 512-byte alignment not sign. Passing del_num[1]=LLONG_MIN satisfies LLONG_MIN%512==0 then byte_count=MIN(bytes_left 0x7FFF8000) yields LLONG_MIN which truncates to int byte_count=0 (low 32 bits of 0x8000000000000000 are 0). Loop body issues zero-block TRIM and bytes_left-=0 leaves bytes_left unchanged looping forever. Each iteration allocates kernel buffer -> reliable kernel-thread hang + memory pressure. Smaller negative values truncate to negative bp->b_bcount passed into device strategy.