vniocattach_file missing positive vn_size check -> signed integer overflow and bogus disk geometry

Summary

Swap-backed attach validates vn_size>0 (:617) but file-backed attach does NOT. vn.c:559-560 if(vio->vn_size) vn->sc_size=vio->vn_size*PAGE_SIZE/vn->sc_secsize. vn_size int64_t PAGE_SIZE int signed multiplication overflows for large magnitudes. Negative vn_size negative product divided by 512 negative quotient reinterpreted as huge u_int64 in sc_size. Bogus sc_size published as disk media size used to derive cylinder geometry with truncation to u_int. Contrast swap path guards vn_size<=0 EDOM. SYSCAP_RESTRICTEDROOT gated root-only. Impact logic/DoS bogus capacity geometry garbage not memory corruption.