ioapic.c parameter-validation gap cluster: containment-defeating overlap test, npin<=0 acceptance, negative-pin acceptance in ioapic_gsi(), and completely unvalidated pin/select in ioapic_pin_prog() (the sink of the ABI entry points DF-5351/5352 proved callable on production kernels)

Summary

The overlap test checks only endpoint membership - a new range fully containing an existing one passes both disjuncts and registers nested GSI spaces (misrouting all contained GSIs to the outer controller); npin<=0 accepted; ioapic_gsi checks only the upper bound; pin_prog computes the REDTBL select from pin with NO bounds at all - the in-file sink for the MachIntrABI entry points DF-5351/5352 proved reachable from KLD with no runtime checks anywhere. MMIO-window addressing keeps it undefined-register programming rather than kernel-memory corruption. Sub-issues 1+2 closed by the validated DF-5502 fix; add pin bounds to gsi()/pin_prog.