iwm_notif_intr() reads hw = le16toh(sc->rxq.stat->closed_rb_num) & 0xfff and
loops while (sc->rxq.cur != hw) without masking hw to the ring size (512 entries
for 9000-series MQ RX, 256 for legacy). If the hardware reports a value at or
above the ring size, cur never equals hw: the loop walks stale ring entries
indefinitely and the write-pointer update uses a bogus index. Linux iwlwifi
masks the value (5eae443eb5e2) and OpenBSD has done the same since 9000-series
support was added (3287dca4fa10).
This was found while debugging an iwm crash on another BSD using the same
driver lineage (DragonFly, upstream bug 3449)
Locally tested:
- 7260, 9260, STA mode
PR: kern/299427
Submitted by: David Bidner <david@crap.solutions>