mmap: introduce sane default mmap limits