validate_tx_req_id inverts its NULL check — latent NULL-pointer dereference on out-of-range TX req_id (currently dead code)

Summary

When req_id >= tx_ring->ring_size, tx_info stays NULL and line 1187 dereferences tx_info->mbuf ('if (tx_info->mbuf == NULL)' should be 'if (tx_info == NULL)' - the else-branch text 'Invalid req_id' proves the intent). Porting transcription error. Currently unreachable because ena_com_tx_comp_req_id_get rejects req_id >= q_depth and q_depth == ring_size; also, unlike validate_rx_req_id, it does not set trigger_reset. Becomes a device-triggerable NULL-deref panic the moment the ena_com check is relaxed or ring sizes diverge.