Addressed code review feedback.

Review comments:

• bnxt_ptp_timer() had exactly one caller (bnxt_calibration_callout()) and did nothing but re-check for a NULL ptp_cfg that bnxt_ptp_get_current_time() already checks itself. Inline the call to bnxt_ptp_get_current_time() and remove the wrapper.
• bnxt_calibration_callout()'s "HW timestamp frozen" branch re-tested priv->clbr_done != 0 inside a block already entered on priv->clbr_done &&; the inner check was always true. Flattened.
• bnxt_ptp_init() called bnxt_hwrm_func_drv_rgtr(bp, NULL, 0, true) with its return value discarded. With async_only=true this only re-sends the *default* async-events bitmap (no PTP-specific bits are added, since bmap is NULL) - the exact same bitmap the initial driver registration at attach already sent - so the call has no effect on what firmware forwards. Compare bnxt_register_async_events() in bnxt_ulp.c, which passes an actual extra bitmap for this same call to register RoCE's additional events; PTP does no such thing here. Removed as a no-op.
• This file mixed Linux-style negative errno returns (-EINVAL, -ENODEV, -EIO, -ENOMEM in bnxt_map_ptp_regs(), bnxt_ptp_init_rtc(), __bnxt_refclk_read(), and bnxt_hwrm_ptp_qcfg()) with the positive FreeBSD-convention errno already used elsewhere in the same functions and file (e.g. hwrm_send_message()'s return, and every other bnxt_en source file). None of the current callers inspect the sign, but it's a trap for any future == ENODEV-style check and inconsistent with driver style(9). Changed all five to positive.
• bnxt_ptp.h redefined BNXT_GRCPF_REG_CHIMP_COMM, BNXT_GRCPF_REG_CHIMP_COMM_TRIGGER, BNXT_GRCPF_REG_WINDOW_BASE_OUT, BNXT_GRC_BASE_MASK, and BNXT_GRC_OFFSET_MASK with byte-for-byte identical values to bnxt.h, which bnxt_ptp.h already #includes. Removed the duplicates.
• struct bnxt_ptp_cfg's clbr_gen field was never read or written anywhere. Removed.

AI scan (pass 1):

• The RX timestamp path dereferenced softc->ptp_cfg solely under if (softc->rx_ts_enabled), relying on an invariant enforced only in a different file (rx_ts_enabled is set true in if_bnxt.c only after ptp_cfg is allocated). Guard the deref directly with && softc->ptp_cfg != NULL so this file doesn't depend on that invariant holding across future changes.

AI scan (Pass 2):

• bnxt_ptp_free() destroyed ptp_lock but never callout_drain()'d tstmp_clbr, relying entirely on bnxt_stop() always running first (it does today, but bnxt_ptp_free() shouldn't depend on that ordering silently). Move callout_init() from bnxt_init() into bnxt_ptp_init() (paired with mtx_init()) so ptp_lock being initialized reliably implies the callout is too, then callout_drain() it in bnxt_ptp_free() under that same guard, before destroying the lock the callout body takes.
• bnxt_hwrm_ptp_qcfg()'s no_ptp: label freed ptp directly instead of calling bnxt_ptp_free(), which was safe only because every failure reaching it today happens before mtx_init(). If bp->ptp_cfg is ever reached here already holding a fully-initialized struct from a prior call, the mutex/callout would leak. Use bnxt_ptp_free(bp).
• bnxt_unmap_ptp_regs() unconditionally cleared a GRC window register that bnxt_map_ptp_regs() never actually maps (it rejects any refclk register requiring one, returning EINVAL). Removed the function and its one call site; there's nothing to unmap.
• bnxt_calibration_callout()'s frozen-counter path invalidated a calibration slot with atomic_store_rel_int(&curr->gen_ts, 0), a bespoke sentinel outside the seqcount API, only made to work by bnxt_ptp_hwtstamp_to_ns()'s non-standard if (gen == 0) return 0 check. Switched to the standard seqcount "permanently odd" idiom: the writer leaves gen_ts odd (still via a plain store, not seqc_write_begin(), which critical_enter()s with no matching seqc_write_end() to critical_exit() again here); the reader uses seqc_read_any()+seqc_in_modify() instead of seqc_read(), which would otherwise spin forever on a permanently-odd value instead of the transient-writer case it's designed for.
• Removed BNXT_HI_TIMER_MASK64, BNXT_HI_TIMER_SHIFT, and (once the bnxt_unmap_ptp_regs() removal above made it dead too) BNXT_PTP_GRC_WIN_BASE / BNXT_PTP_GRC_WIN: all unused.
• Renamed clbr_done to clbr_ticks: it's an unbounded per-tick counter gating the stall check and the first-tick path in bnxt_reset_calibration_callout(), not a boolean, despite the name.