rc4_init lacks keylen>0 validation reading key[0] 256 times for non-positive keylen

Summary

rc4_init KSA loop reads key[k] at :72 BEFORE the keylen check at :74. With keylen<=0 (or non-positive int) ++k>=keylen is always true so k=0 every iteration - loop reads key[0] 256 times into the S-box with a possibly-NULL key pointer. Defensive defect: every in-tree caller (ng_mppc ng_mppc7) passes keylen=8 or 16 from validated PPP config with a 16-byte key buffer. No current path triggers it but latent API misuse risk.