Memory corruption via unchecked capacity arithmetic

Heap buffer overflow in Servo Project smallbitvec 1.0.1 through 2.6.0 allows local users to corrupt process memory via safe APIs. The buffer_len helper adds a rounding constant to a caller-supplied capacity without checked arithmetic, so release builds can wrap near usize::MAX, allocate insufficient backing storage, and retain oversized metadata. Subsequent set, push, or reserve calls reach unchecked indexing or pointer arithmetic; exploitation requires a consuming process to pass an extreme capacity and can corrupt or crash that process.