_table() passes DM_MAX_PARAMS_SIZE instead of remaining buffer space to ksnprintf (latent OOB-write enabler)

Summary

dm_target_delay_table composes status string by repeatedly calling _table()/ksnprintf into DM_MAX_PARAMS_SIZE(1024) buffer advancing p by value returned by ksnprintf (would-have-written not actual written) then passing DM_MAX_PARAMS_SIZE (not remaining slack) as size to next ksnprintf. _table also passes DM_MAX_PARAMS_SIZE rather than remaining. If field bound ever widened p would jump past params+1024 and subsequent ksnprintf would write past buffer. No demonstrated impact today (udev_name bounded 32 bytes). Hardening/defense-in-depth.