sbuf_uionew truncates ssize_t uio_resid to int length then uiomove()s full original size into undersized buffer

Summary

sbuf_uionew constructs backing buffer with sbuf_new(s NULL uio->uio_resid+1 0) where uio_resid is ssize_t(64-bit) but length is int. For uio_resid whose low 32 bits of (resid+1) are small (e.g. 0x100000000 -> length=1) allocated s_buf far smaller than uio_resid. Next statement does uiomove(s->s_buf uio->uio_resid uio) with untruncated 64-bit resid writing gigabytes into tiny kernel buffer heap overflow. s_size also set to s_size-1 in ssize_t while buffer int-sized. Today sbuf_uionew has ZERO in-tree callers latent until wired.