vfs, fdtable: Prevent bounds-check bypass via speculative execution