HBSD: constify sv_pax_aslr_init

Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org>
HBSD JANITOR: remove aout leftover

Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org>
Bump the largest record we can cope with from 1k to 8k. Other users of
the hints file don't have any real limits, and longer records will
need to be written shortly.
Adjust the test of a KASSERT to better match the intent.

This assertion was added in r246213 as a guard against corrupted mbufs
arriving from drivers, the key distinguishing factor of said mbufs being
that they had a negative length. Given we're in a while loop specifically
designed to skip over zero-length mbufs, panicking on a zero-length mbuf
seems incorrect.

No objection from:	kib
Reduce number of places where global control_softc is used.

At some point we may want to have several CTL instances, and that is not
really impossible.

MFC after:	2 weeks
Constify some static data.

MFC after:	2 weeks
HBSD: prevent init hijacking if PAX_HARDENING enabled

init hijacking steps:

user$ cp /sbin/init /usr/home/user/init # or just create an initit compatible exploit
ctrl + alt + del
freebsd-loader: ESC
freebsd-loader: set init_path="/usr/home/user/init"
freebsd-loader: boot

and voila, the system booted fine with modified init, even if enabled
root password checking to system console in single user mode.

Probably the modified init could touch sensitive data (master.passwd, ...)

github-issue: #28
Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org>
HBSD: build fix after latest commit

github-issue: #28
Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org>
Merge remote-tracking branch 'freebsd/master' into hardened/current/master
Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/segvguard