Key-size validation is no-op KASSERT invalid keyBits silently yields Nr=0 and runaway loop / OOB read

Summary

rijndaelKeySetupEnc validates keyBits ONLY via KASSERT which in production/release kernels (INVARIANTS undefined) expands to do{}while(0). With invalid keyBits none of three size branches taken function returns Nr=0 leaving rk[4..] uninitialized. rijndael_set_key stores Nr=0 without checking. rijndaelEncrypt computes r=Nr>>1=0 loop if(--r==0)break sets r=-1 never re-reaches 0 so loop runs indefinitely advancing rk+=8 each iteration past ek/dk buffers reading OOB kernel memory until faults unmapped page -> kernel hang/panic. All current in-tree callers pre-validate keyBits so not directly exploitable today but latent DoS landmine.