The NR_OPEN check in F_DUPFD is unneeded.  viro says:

"We check the limits in locate_fd() (called by dupfd()).  Check for NR_OPEN
can (and should) be dropped - locate_fd() will never go beyond that
(expand_fd() will check it and refuse to go).

"IOW, simply lose the check.  We _might_ want to check signedness, but that's
it (IOW, check that arg will fit into 0..MAX_INT; second argument of dupfd()
is an int).  OTOH, we might actually make dupfd() et.al.  take unsigned long
and kill that crap completely."

And indeed, the signedness is suspicious, so make various things in there
unsigned too.