OOB read: gain_table_entries[32] via unclamped gain_index in ar9300_paprd_setup_gain_table

Summary

In ar9300_paprd_setup_gain_table gain_index search loop (lines 2003-2009) increments gain_index for every gain-table entry below desired_gain. When desired_gain exceeds all 32 entries (8-bit values 0-255) gain_index reaches 32. Passed unclamped to ar9300_tx_force_gain(ah 32) which indexes gain_table_entries[32] one element past end of 32-element paprd_gain_table_entries array. Read lands on paprd_gain_table_index[0] adjacent struct field. No crash (intra-struct) no info leak (value goes to MMIO) but incorrect TX-forced-gain written to radio. Trigger: desired_gain > max(paprd_gain_table_index[0..31]) or negative internal result casts to huge unsigned. Attacker: malicious/faulty ath adapter controls MMIO register reads and EEPROM data. PAPRD calibration uses internal RF loopback not external input so local unprivileged users cannot directly trigger. Impact: RF compliance/performance degradation no kernel memory corruption. CONTRIBUTED vendored code upstream owns fix.