Ticket legacy/trac#24423 found a possible integer overflow with: ``` tcp_space = (ent->cwnd - ent->unacked) * (int64_t)ent->mss; ``` ... if we ever end up with `cwnd` being smaller than `unacked`. I've observed this on a relay leading to huge values for `tcp_space` which leads to the wrong TCP limit for the channel. Any overflow should result in `tcp_space = 0` in practice.