bwn_phy_shm_tssi_read returns positive ENOENT but callers test < 0: the invalid-TSSI sentinel is treated as a valid TSSI of 2, so TX-power recalculation always 'adjusts' on fabricated data

Summary

bwn_phy_shm_tssi_read signals 'no valid TSSI data' by returning ENOENT - but ENOENT is +2 on DragonFly, while its only caller detects the invalid case with 'if (cck < 0 && ofdm < 0)'. A positive +2 return can never satisfy those tests, so the designed invalid-data path is unreachable: whenever the SHM word still holds the sentinel bytes - the normal state before/between real measurements (the driver itself resets it after each read) - recalc_txpwr proceeds with a fabricated tssi=2, updates pg_avgtssi with it, and issues a spurious NEED_ADJUST with rfatt/bbatt deltas computed from -2..-6 dB of phantom error. Systematic TX-power misadjustment on every recalculation cycle; ignore_tssi is likewise dead. FreeBSD main is byte-identical (upstream-inherited). Any bwn G-PHY device: fires on the ordinary no-data path. Wrong transmit power (RF correctness/regulatory), not memory unsafety. Two-character fix (return -ENOENT).