Missing sopt_valsize validation causes OOB heap read in every set-mutation handler

Summary

move_set move_rule swap toggle flush all cast sopt->sopt_val to (int*) deref without checking sopt_valsize large enough. With small valsize(e.g. setsockopt buf 1) deref reads past kmalloc sopt_val buffer into adjacent slab bytes. Needs 8 bytes(move/swap) 4 bytes(toggle/flush) checks none. ipfw2 sibling validates everywhere ipfw3 does not. OOB values consumed only inside range checks (0,32) never returned no direct disclosure. Defense-in-depth hardening.