No boundary check on od_open_ref

Both in and `os_dev_open()` and `os_dev_close()` there is no boundary check done while incrementing/decrementing `od_open_ref` value. This leads to an underflow when trying to close an already closed device.

Locate the implementations of os_dev_open() and os_dev_close(), then inspect how they increment and decrement od_open_ref. Confirm the boundary behavior for repeated closes and opens, and consider the issue complete when closing an already closed device no longer underflows the reference count.

Written by the indexing model from the issue text.