A short socket-control buffer could make the kernel write past it

9c51b1274871 (claudio@, 2026-08-26 02:26:30 PDT). sys/kern/uipc_syscalls.c. source-changes: Fix control message handling in recvit to avoid out of bounds write to userland.

An unsigned length can underflow on unchecked ALIGN() when the buffer is too short and not a multiple of _ALIGNBYTES+1. Adds an overflow check and uses socklen_t for msg_controllen. Programs that size the buffer with CMSG_SPACE were not hit. In base only dig uses a non-rounded buffer, and it is oversized enough. Reported by Acts1631 who also provided a fix. OK millert@ deraadt@. Not labeled SECURITY FIX.