# DF-3836 — `static` channel-table pointer in bwn_phy_lp_b2063_switch_channel keeps the previous entry on lookup failure → radio silently tuned to the wrong channel

- File: `sys/dev/netif/bwn/bwn/if_bwn_phy_lp.c` (pass 2)
- Class: CWE-457 (stale state via `static` local) → wrong-frequency operation; success returned
  for an unsupported channel
- Severity: Low (reachability constrained: callers pass net80211-validated channel numbers, all
  of which are present in the table today; the bug turns any future/edge miss from a clean
  EINVAL into silent mistuning)
- Upstream-inherited: FreeBSD head has the identical `static const struct bwn_b206x_chan *bc`
  in bwn_phy_lp_b2063_switch_channel (their line 815); note their b2062 variant correctly uses
  a non-static local (their line 954), as does DragonFly's (line 926).

## Build / Run / Expected
Hardware-gated (env.txt). Mental test, source-level:

    call 1: bwn_phy_lp_b2063_switch_channel(mac, 36)   -> bc = &table[17], OK
    call 2: bwn_phy_lp_b2063_switch_channel(mac, 9x)   -> 9x not in table; loop ends without
              match; bc STILL &table[17] from call 1 (static!) -> NULL check passes ->
              radio reprogrammed for channel 36's RF values, returns 0 (success)

Expected on vulnerable code: `bwn_phy_lp_switch_channel` then records `plp->plp_chan = chan`
(the unhandled one) and writes it to BWN_CHANNEL — the stack believes it is on the new channel
while the RF is on the old one (regulatory/interference hazard, association failure).

## Root cause
if_bwn_phy_lp.c:792-808:

        static const struct bwn_b206x_chan *bc = NULL;   /* STATIC */
        ...
        for (i = 0; i < N(bwn_b2063_chantable); i++) {
                if (bwn_b2063_chantable[i].bc_chan == chan) {
                        bc = &bwn_b2063_chantable[i];
                        break;
                }
        }
        if (bc == NULL)
                return (EINVAL);

The `static` keyword makes `bc` persistent across calls, so the `bc == NULL` failure detection
only works on the very first invocation. The sibling function
`bwn_phy_lp_b2062_switch_channel` uses a plain (non-static) `const struct bwn_b206x_chan *bc`
(line 926) — the intended form.