Potential integer overflow in dynbuf growth logic

### Summary I observed a potential integer overflow in curl’s dynbuf growth logic. ### Details - The guard I mentioned earlier was added in my own proof-of-concept harness, not part of standard curl. - This condition appears to be network-triggerable, since curl processes lengths from remote input. - Because this may be security-sensitive, I have reported full details privately to the curl security team. ### Environment - curl version: 7.81.0 - Operating system: Ubuntu 22.04, kernel 6.8.0-124-generic ### Next Steps Please refer to my private disclosure for PoC, sanitizer output, and suggested fix.