setgroups check int > NGROUPS, so negative would fail; minor cleanup