nxpwifi_is_tx_ba_stream_ptr_valid() returns true when the entry is still
linked, and every caller passes an entry that is on the list, so the early
return always fires and nothing is ever unlinked or freed. Entries leak on
every teardown and, since nxpwifi_space_avail_for_new_ba_stream() counts
them, Tx aggregation stops being negotiated once the stale count reaches
the maximum.

Changing the original dead && test to || to silence a NULL dereference
report inverted the validity test along with it.

Fixes: 00c786a7581e ("wifi: nxpwifi: fix multiple static analysis errors and warnings")
Assisted-by: Claude:claude-opus-5
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>

Fix various development-phase bugs, code quality, and logical issues
reported by the kernel test robot (using the Smatch static analysis tool).

The following addressable fixes are included:

- 11n.c & 11ax.c: Fix potential NULL pointer dereferences by correcting
  logical operators (&& to ||) in 11n.c and hoisting the bss_desc
  verification to the top of the function in 11ax.c.
- 11n.c: Fix a severe Use-After-Free (UAF) memory corruption during RCU
  list traversal. Restore the proper list_for_each_entry_safe() loop
  structure along with the required array index [i] within the locked
  writer path.
- sdio.c: Fix a missing unwind resource cleanup pathway where a protocol
  error branch returned directly via -EINVAL instead of using
  'goto term_cmd', leaving the SDIO hardware state machine out of sync.
- main.h: Fix a signedness mismatch bug where nxpwifi_get_unused_bss_num()
  could return -2 as an unsigned integer fallback.
- util.c: Remove a redundant and dead condition check (position <= 15)
  which was always true for a 4-bit unsigned bit-field member variable.
- cfg80211.c: Clean up a dead unreachable 'return 0' at the bottom of the
  switch-case logic.
- uap_txrx.c: Clean up mismatched and inconsistent indentations within the
  handling of multicast RX forward paths.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202608020855.QwN5n7i5-lkp@intel.com/
Assisted-by: Gemini:unknown-model
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>
Link: https://patch.msgid.link/20260803162741.438820-1-chunfan.chen@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Add support for the NXP IW61x wireless devices.

The nxpwifi driver implements a full-MAC design and integrates with
cfg80211 for configuration and control, supporting both station (STA)
and access point (AP) modes.

The driver provides a firmware-based command/event interface using TLV
messages, with the core handling command processing, event dispatching,
and device lifecycle management. A SDIO transport layer is implemented
to support IW61x devices.

Key features include:
- 802.11n/ac/ax (HT/VHT/HE) capability support
- Scan, association, and connection management
- Data path handling for TX/RX, including aggregation and reorder
- WMM QoS support and traffic prioritization
- 802.11h (DFS/TPC) support for regulatory compliance
- cfg80211 integration for STA and AP operations
- Debugfs and ethtool support
- Wake-on-LAN support

The driver translates cfg80211 configuration into firmware commands
and implements required data path processing in software where needed.

Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>