Unbounded linear search in mt7601_set_chan reads past mt7601_rf_chan[14]

Summary

mt7601_set_chan finds per-channel RF settings with for(i=0 mt7601_rf_chan[i].chan!=chan i++) no upper-bound test. mt7601_rf_chan has exactly 14 entries (channels 1-14). If chan anything other than 1-14 loop walks off end of static const array into adjacent .rodata until matches garbage word (programs radio with garbage) or runs into unmapped page panics. Caller mtw_set_chan only rejects chan==0 and chan==IEEE80211_CHAN_ANY(255) permits any chan 1..254. Defense-in-depth failure - driver advertises only 2GHz channels via mtw_get_radiocaps so normally constrained to 1..14.