MFC r296502, r296543, r296546, r297060:

1. Limit secs to INT32_MAX / 2 to avoid errors from kern_setitimer(). Assert that kern_setitimer() returns 0. Remove bogus cast of secs. Fix style(9) issues.
2. Increment the return value if the remaining tv_usec value more than 500000 as a Linux does.