exec: Linux's 2 MB of arguments; mmap: merge neighbouring mappings

exec took 32 arguments and 64 environment variables, in fixed arrays,
so a glob over more than 31 files failed with E2BIG. It now reads the
caller's argv and envp where they are, through the uaccess helpers and
a bounce page -- a second thread rewriting the array after a check
cannot slip a kernel address in -- and sizes the new stack to fit
them. The limits are Linux's: ARG_MAX, 2 MB of strings and pointers,
and 128 KB for any one string (USER_STR_MAX follows it).

Every mmap took one of a process's 256 VMA slots, and zsh takes one per
16 KB heap block, so `x=($(<file))` over 30000 words ran out after 4 MB
of heap and exited 1 without a word. Neighbouring anonymous mappings
now share a record, as Linux merges them -- the bump allocator puts
each new one where the last ended -- and munmap trims or splits it.
Partial unmaps of device or segment mappings are refused with EINVAL
instead of kfree()ing pages that are not the process's, and a failed
allocation half way through a mapping no longer leaks what it had.

Checked under QEMU: touch over 3000 names, /bin/echo with 50000
arguments, E2BIG past 2 MB, zsh splitting 100000 words, fork loops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4

docs/history/kernel.md

@@ -1079,6 +1079,23 @@ memory. Three translations from the truth.
 
 `NVMA` is 256 and the failure returns `-ENOMEM`.
 
+256 ran out too, later, and silently: `x=($(<file))` over 30000 words exited
+zsh with status 1 and no message. zsh takes one 16 KB mapping per heap block,
+so 256 slots was 4 MB of heap. Neighbouring anonymous mappings are merged into
+one record now, as Linux merges them. Addresses come from a bump allocator, so
+a new mapping nearly always starts where the last one ended. `munmap` trims or
+splits the record. The slots now bound how many *separate* regions a process
+holds, not how many `mmap` calls it has made, and 100000 words split fine.
+
+### exec took 32 arguments
+
+`MAXARG` was 32 and `MAXENV` 64, in fixed arrays, so `rm *.o` in any build
+directory failed with `E2BIG`. exec now reads the caller's arrays where they
+are, through the uaccess helpers and a bounce page, so a second thread
+rewriting them cannot slip a kernel address in after a check. It sizes the new
+stack to fit them. The limits are Linux's: 2 MB of strings and pointers
+(`ARG_MAX`), and 128 KB per string.
+
 ### And underneath all of it: a small write costs 58 ms
 
 With everything above fixed, `compinit` still appeared to hang. It was not