ieee80211_compute_duration reads rt->info[rix] without bounding rix against IEEE80211_RATE_TABLE_SIZE (latent OOB read)

Summary

ieee80211_compute_duration (ieee80211_phy.c:506-511): line 506 rix=rt->rateCodeToIndex[rate] (uint8_t 0-255). Line 510 KASSERT(rix!=(uint8_t)-1) compiled out production. Line 511 kbps=rt->info[rix].rateKbps. rateCodeToIndex init to (uint8_t)-1 for all 256 slots :307-308 only valid rate codes overwritten :329. Unknown rate -> rix=255 -> info[255] reads 128 entries past info[IEEE80211_RATE_TABLE_SIZE=128]. 127*12=1524 bytes past rate_table struct into adjacent static data read-only no write. Documented precondition (caller must pass valid rate) enforced only by KASSERT. No demonstrated exploit with current callers (all 6 call sites pass validated rates). Info/speculative defense-in-depth hardening. Fix: if(rix==(uint8_t)-1||rix>=IEEE80211_RATE_TABLE_SIZE) return 0.