7370d6a818
ConntrackTable gains max_entries: usize field (default 65536). When the table reaches this limit, new connections return ConnState::OverLimit instead of being inserted. Enforced at both insertion points: - TCP/UDP track() path (new connections) - ICMP echo track_icmp() path (new ICMP entries) Stats output now includes max_entries: N. Mirrors Linux net.netfilter.nf_conntrack_max (default 65536). All 31 tests pass.