Avoid wraparound when casting unsigned size_t to signed ssize_t.