Limit descriptors and enter capability mode.

Differential:	D1009
Reviewed by:	jonathan, pjd
MFC after:	2 weeks
Relnotes:	yes


git-svn-id: svn+ssh://svn.freebsd.org/base/head@274960 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f