Remote net80211 taskqueue wedge: urtwn_tsf_task_adhoc sleeps hz*ni_intval*5/1000 with attacker-controlled IBSS beacon interval

Summary

usb_pause_mtx on the SHARED net80211 taskqueue thread with ni_intval copied verbatim from received management frames: attacker beacon (larger TSF forces merge -> S_RUN re-entry -> tsf_sync) with interval=65535 parks the wlan taskqueue ~5.5 minutes per merge holding a bss node ref - sustained starvation of ALL net80211 deferred work system-wide, unauthenticated remote DoS. Clamp-the-pause (or validate ni_intval in the net80211 parser) fix.