# DF-4734 — ar5210ResetTxQueue dereferences ah_curchan without the NULL guard both siblings carry

**File**: `sys/dev/netif/ath/ath_hal/ar5210/ar5210_xmit.c:157,180`
**Severity**: Low (latent NULL-deref panic; in-tree call order protects) — **certain** on the divergence.

## Root cause
`ar5210ResetTxQueue` takes the current channel

```c
157:	const struct ieee80211_channel *chan = AH_PRIVATE(ah)->ah_curchan;
```

and, for every DATA queue, dereferences it unconditionally:

```c
180:	if (IEEE80211_IS_CHAN_TURBO(chan)) {
```

`IEEE80211_IS_CHAN_TURBO(_c)` is `((_c)->ic_flags & IEEE80211_CHAN_TURBO) != 0`
(`sys/netproto/802_11/_ieee80211.h:268`) — a plain deref. `ah_curchan` is `AH_NULL`
from attach until the first `ar5210Reset` runs.

Both sibling HALs guard exactly this and annotate *why*:

- `ar5211_xmit.c` (ar5211ResetTxQueue): `/* NB: chan can be NULL during attach */`
  followed by `if (chan && IEEE80211_IS_CHAN_B(chan))` — chan used nowhere else.
- `ar5212_xmit.c` (ar5212ResetTxQueue): identical guard, identical comment.

The 5210 HAL missed the guard, and unlike its siblings it uses `chan` for the whole
IFS programming branch (turbo vs normal), so the deref executes on **every** DATA
`resetTxQueue` call with a NULL channel.

## Reachability (why latent)
In-tree order: `ath_attach` runs `ath_hal_reset` (sets `ah_curchan`) before
`ath_txq_setup` calls `ath_hal_resettxqueue` (`if_ath.c:4125-4130`), and the only other
caller (`ath_txq_update`) runs after channel changes. So no in-tree path reaches the
deref with `chan == AH_NULL`; a driver variant (or future caller) that sets up/resets
a DATA queue before the first channel reset takes a NULL-deref kernel panic. Same
"latent, caller-order-protected" class as the DF-4519/4712/4733 family.

## Reproduce
Hardware-gated (no Atheros NIC on the guest). Source-confirmed divergence plus
fix build-validation:

```
scp fix.diff guest:/tmp/df4734.diff
vm.sh run_root 'cd /usr/src && patch -p1 < /tmp/df4734.diff && make nativekernel KERNCONF=X86_64_GENERIC'
# expected: BUILD_RC=0, ar5210_xmit.c compiled -Werror (build.log)
```

## Fix
`fix.diff`: `if (chan != AH_NULL && IEEE80211_IS_CHAN_TURBO(chan))` with the siblings'
comment — NULL channel takes the normal-mode defaults, matching ar5211/ar5212 semantics
(they fall back to `INIT_CWMIN` when chan is NULL).