bhyve: fix integer overflow in qXfer packet parser

doff + dlen overflows unsigned int when both values are close to UINT_MAX,
causing the wrong branch to execute and passing an unbounded length to
append_binary_data().  Rewrite the comparison to avoid the addition.

Reviewed by:	markj
Fixes:		f81cdf24ba ("bhyve: Add support for XML register definitions")
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D60847

(cherry picked from commit 5ce0ab7355)

usr.sbin/bhyve/gdb.c

@@ -1695,7 +1695,7 @@ gdb_query(const uint8_t *data, size_t len)
 		start_packet();
 		if (doff >= xmllen) {
 			append_char('l');
-		} else if (doff + dlen >= xmllen) {
+		} else if (dlen >= xmllen - doff) {
 			append_char('l');
 			append_binary_data(xml + doff, xmllen - doff);
 		} else {