Silent uint16_t truncation of iv_swbmiss_period can yield zero (callout flood DoS)

Summary

tdma_newstate computes swbmiss period via IEEE80211_TU_TO_TICKS() returns uint64_t but stored in iv_swbmiss_period uint16_t. Truncation can yield period=0 causing callout_reset fire every tick flooding taskqueue with bmiss tasks rapid beacon-miss->scan->rejoin cycling. Attacker as TDMA master controls tdma_bintval and tdma_slotlen via beacon IE. Zero-producing example hz=1000 bmissthreshold=5 bintval=128 slotlen=256: inner TU=64000 TU_TO_TICKS=65536 uint16_t truncates to 0.