int8_t overflow in bwn G-PHY tssi2dbm table generation: clamp to 128 wraps to -128 (DFly divergence; FreeBSD clamps to 127), corrupting TX-power control

Summary

bwn_phy_g_attach generates the 64-entry TSSI-to-dBm table from SPROM coefficients and stores each entry with a MIN(MAX(x,-127),128) clamp into an int8_t. The upper clamp of 128 does not fit int8_t: a computed value >=128 is stored as -128 (two's-complement wrap). FreeBSD main clamps to 127 - an upstream-fixed divergence live in DragonFly. The corrupted entry is later consumed as a signed dBm offset in recalc_txpwr and uploaded verbatim to PHY tables, so a +128 dBm reading becomes -128 dBm: the power-error term flips sign and grows by up to 256, driving rfatt/bbatt deltas to the clamp extremes and pinning TX power to max or min attenuation - systematically wrong (possibly regulatory-exceeding or link-killing) transmit power on affected hardware. Requires a G-PHY device whose SPROM coefficients produce a value >=128 for some TSSI index. No kernel memory-unsafe effect. One-character fix (128 -> 127).