This function constructs the NDisc Encrypted DNS option (RFC 9463).
`poff` is initialized to `off + sizeof(uint16_t)` - pointing past the 2
bytes SvcParam length field. After all SvcParams are written the length
is set at line 1541. `LESS_BY(poff, off) = poff - off` includes the 2
bytes length field itself. The correct value is `poff - off -
sizeof(uint16_t)`.
Standard Linux POSIX ACL tag values are 0x00, 0x01, 0x02, 0x04, 0x08,
0x10 and 0x20. ELEMENTSOF(tag_map) evaluates to 33, which is one past
the last valid index 32.