ath_txq_addholdingbuf bounds check is off-by-one and comes after the OOB pointer arithmetic; ath_freebuf has no check at all (hardening, currently unreachable)

Summary

ath_txq_addholdingbuf computes txq = &sc->sc_txq[bf->bf_state.bfs_tx_queue] BEFORE validating the index, and the validation itself is 'if (bfs_tx_queue > HAL_NUM_TX_QUEUES)' - off-by-one: index == HAL_NUM_TX_QUEUES (10) passes and would lock/deref sc_txq[10], one past the 10-element array. ath_freebuf performs the same indexing with no check whatsoever. Currently unreachable: bfs_tx_queue is only ever assigned from txq->axq_qnum and ath_txq_setup already rejects HAL queue numbers >= nitems(sc_txq). Defense-in-depth - if any future path (e.g. the hardware-fed status family of DF-1723) leaks an unclamped queue number into bf_state, this off-by-one converts it into a one-past-end lock/acquire/write. Fix: validate before indexing with >=.