libredox: replace demux() .expect() with .unwrap_or(u16::MAX)

CRITICAL F3.1 from NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md
§3.4: demux() panicked on edge-case errno via '.expect("2^BITS - res < 4096")'.
Called from every syscall wrapper (~40 call sites). A kernel returning
errno outside the 0..=4095 range would panic the entire process.

Fix: saturate to u16::MAX on overflow rather than panic. The errno
field is u16; values above u16::MAX indicate a kernel ABI violation,
and surfacing u16::MAX is safer than crashing every caller.

Trivial change (one line: .expect -> .unwrap_or(u16::MAX)) with a
comment explaining the saturate-vs-panic tradeoff.

src/lib.rs

@@ -40,7 +40,12 @@ pub mod error {
         pub fn demux(res: usize) -> Result<usize, Self> {
             if res > usize::wrapping_neg(4096) {
                 Err(Self {
-                    errno: res.wrapping_neg().try_into().expect("2^BITS - res < 4096"),
+                    // Saturate to u16::MAX on overflow rather than panic; the
+                    // demux ABI returns the errno in the low 16 bits of a usize,
+                    // and `wrapping_neg(4096)` is the boundary. Values above
+                    // u16::MAX indicate a kernel ABI violation; surfacing
+                    // u16::MAX is safer than panicking every syscall wrapper.
+                    errno: res.wrapping_neg().try_into().unwrap_or(u16::MAX),
                 })
             } else {
                 Ok(res)