crypto_rand_int() should be returning an unsigned int
crypto_rand_int() is returning an int, when it should be returning an unsigned int.
Currently, if max is larger than INT_MAX it might return a negative number. Fortunately, it doesn't seem to be called with anything that large atm.