Uninitialized stack reads in create_pa_curve when training bins lack samples

Summary

create_pa_curve declares fixed-size stack arrays theta[NUM_BIN+1] x_est[NUM_BIN+1] y[NUM_BIN+1] without initialization (lines 1398-1404). First loop (1449-1498) only writes x_est[bin+1] y[bin+1] theta[bin+1] when accum_cnt[bin] > thresh_accum_cnt(16). If fewer than 6 bins meet threshold (max_index<6) then theta[1..5] x_est[6] y[6] remain uninitialized stack garbage. These used unconditionally: theta[1..5] summed into theta_low_bin (line 1504-1506) x_est[6]==x_est[3] compared (line 1524) x_est[6]-x_est[3] used in division (line 1527-1529). Uninitialized values propagate through signed multiply/shift chains (lines 1598-1604 1618-1619 1647-1648 1717-1727) causing signed-integer-overflow UB. Final pa_in[] clamped to 1400 pa_angle to +-150 masked to 11 bits written to hardware so no register overflow/crash. Attacker: malicious/faulty ath adapter or real adapter under abnormal RF conditions (no signal/jammed loopback) where insufficient bins accumulate >16 samples. Impact: UB garbage PA predistortion table degraded TX linearity/RF compliance. No kernel crash no memory corruption no info leak values stay kernel-internal. CONTRIBUTED vendored code upstream owns fix.