mvsas: don't allow negative timeouts