Unbounded while(1) loop in ar9300_rf_gain_cap_apply can walk past rx_gain_table[256] (defense-in-depth; not exploitable with current static data)

Summary

ar9300_rf_gain_cap_apply() populates local static u_int32_t rx_gain_table[256][2] then enters while(1) loop that increments i_rx_gain (starting at 160) with NO upper-bound check against array size. Loop termination depends solely on encountering gain-table entry whose top byte <= rf_gain_cap (EEPROM-sourced u_int8_t). With current gain tables (ar9300_common_rx_gain_table_ar9580_1p0 and ar9300_common_rx_gain_table_osprey_2p2 each exactly 256 entries both contain low-top-byte entry within indices 160-167) loop terminates safely within few iterations even for rf_gain_cap=1. However structurally unbounded: if future edit to .ini gain tables removes terminating entry or if rx_gain_table resized loop would read/write past 256-element static buffer into adjacent BSS corrupting other static state. Attacker who controls EEPROM/OTP (malicious PCIe/USB adapter or reflashed EEPROM) can set misc_configuration bit 7 and small non-zero rf_gain_cap to force loop to walk as far as possible. With CURRENT data terminates within 160-167 (ar9580.ini indices 166-167 top byte 0x00). Impact with current data: none. Residual risk: fragile code maintainer editing .ini tables could silently turn into OOB write during device attach reachable by plugging device. CONTRIBUTED vendored code upstream owns fix.