mtw: fix zero-length queue array that can corrupt struct mtw_softc

[markj]

Summary

The mtw softc declares sc_epq with MTW_BULK_RX even though MTW_BULK_RX is enum
value 0, while initialization and queue handling index up to MTW_EP_QUEUES;
attaching a matching USB WLAN device can drive writes past the absent array and
corrupt adjacent softc fields.

This suggested patch sizes sc_epq with MTW_EP_QUEUES so the softc contains the
endpoint queues the driver initializes and uses.

Fixes: c14b01624261 ("mt7601U: Importing if_mtw from OpenBSD")

[bz]

I'll accept this for the queue index problem; looking through the driver it feels like something else got convoluted but I could be wrong on that. @jsm and @adrian should probably cross-check that.

[jsm]

Perhaps also check https://reviews.freebsd.org/D50174 I never committed it because it seemed to get device time outs on aarch64 (rpi4 in my test)

[markj]

In D58897#1352929, @jsm wrote:

Perhaps also check https://reviews.freebsd.org/D50174 I never committed it because it seemed to get device time outs on aarch64 (rpi4 in my test)

I don't have any hardware to test this with, this is a patch that was submitted to secteam. It's clearly "right" since otherwise sc_epq is an array of length 0, and today it works by accident probably because most of the fields following the array are copy+pasted from somewhere and don't actually get used.