sysctl: add some missing input constraint checks