#gotox

BPF verifier patches close gotox DoS and register-leak paths

Indirect-jump handling could stall loading for hours and, on a CFG mismatch, leave callee-saved registers under BPF control.