Integer overflow in aperture bounds check in agp_generic_bind_memory

Summary

Bounds check offset+mem->am_size > AGP_GET_APERTURE(dev) at :522 can be bypassed via unsigned 64-bit integer wraparound. User-supplied pg_start shifted left 12 bits produces offset near 2^64 causing offset+size to wrap to small value that passes check. Also offset<0 is dead code (vm_offset_t unsigned). Signed left shift past sign bit UB per C11. Currently mitigated by chipset-level bind_page bounds checks in all four chipset drivers but generic code is primary defense and is broken. Same pattern replicated in intel-gtt.c:1259-1260.