kernel: fix various cap_ioctls_limit/get edge cases