bpf: Verifier, do_refine_retval_range may clamp umin to 0 incorrectly