Charles,

	Your fix works.

	However, I wonder the rational for callout_schedule() taking a signed
value ever; Particularly given the KASSERT(to_ticks >= 0) being present - Also,
wouldn't a maximum check like KASSERT(to_ticks < (86400 * 30 * hz)) (i.e. under
30 days maximum duration or some other period) make sense also.  Similarly, I
can't see how the t_srtt field in struct tcpcb should ever be negative either,
but here there may be a nuance which I just can't follow (e.g a multiply in the
code somewhere).

	Anyway, please close PR kern/29124 the changes to tcp_input.c (which are
"clearly" *more* correct than my hack) have fixed the issue (as well as kern/22551
and kern/29034 and also today's kern/29134 - though that one is against 2.0).

	Thanks,

	Paul Shupak

P.S. Will somebody issue a pull-up to the 2.0 branch also?