Stack buffer overflow in ar9300_eeprom_restore_internal_address via unchecked EEPROM compression length field

Summary

EEPROM calibration-data parser unpacks 11-bit length field (max 2047) from on-card EEPROM/OTP compression header and uses it to size read into fixed 2048-byte stack buffer word[MOUTPUT]. When header advertises length>=2043 read of compression_header_length(4)+length+compression_checksum_length(2)=length+6 bytes overflows buffer by 1-5 bytes. Original length>=1024 guard disabled behind #ifdef DONTUSE (line 3915). ar9300_compression_header_unpack extracts length=11-bit max 2047 (line 3848). No bounds check follows. ar9300_calibration_data_read_eeprom only checks (address+many)>AR9300_EEPROM_SIZE(16384) no knowledge of caller destination buffer. On 4KB-EEPROM cards all 2053 byte-reads succeed (cptr starts 4095 cptr-2052=2043>=0) EEPROM-controlled data written 1-5 bytes past word[2048] into adjacent kernel-stack locals or stack canary. Attacker: malicious AR9300-series adapter (PCI/PCIe/AHB) with crafted EEPROM or attacker who can program EEPROM (root via HAL_DIAG_EEWRITE). Overflow triggers automatically during driver attach no userspace action needed beyond device presence/hotplug. With stack protector: immediate panic local DoS. Without: adjacent-local corruption could influence switch(code) dispatch or dptr potentially kernel code execution from crafted peripheral. 16-bit additive checksum trivially computable by attacker. CONTRIBUTED vendored code upstream owns fix same bug exists in FreeBSD.