ar5212_attach: halKeyCacheSize taken unclamped from 4-bit EEPROM AR_EEP_KCENTRIES field (up to 32768) vs 128-entry hardware key table; every HAL keycache bounds check validates against the attacker-controlled value

Summary

halKeyCacheSize is stored verbatim from the EEPROM (1<<4-bit field = 1..32768) with no clamp to AR_KEYTABLE_SIZE=128, and every ar5212_keycache bound tests against halKeyCacheSize itself - so entries 128..32767 pass and produce MMIO writes far past the key table into the PHY register block. Latent OOB MMIO-write primitive; defused in-tree only by if_ath's ATH_KEYMAX=128 clamp. Exact structural sibling of DF-4520 (MAXQCU). AH_MIN clamp fix.