SSID/rates/xrates copies rely solely on upstream parse_beacon validation: KASSERT is no-op on production kernels

Summary

sta_add(:282-292): SSID memcpy 2+sp->ssid[1] no local check; rates/xrates copies guarded only by KASSERT (no-op without INVARIANTS). TODO at :289 "XXX validate xrates[1]". Safety depends entirely on parse_beacon IEEE80211_VERIFY_ELEMENT upstream + caller status checks. Latent: future caller regression -> heap overflow. Defense-in-depth.