net80211: clamp negotiated VHT width to our own capability

[gargamel778]

Problem

ieee80211_vht_negotiate() derives support_160, support_80_80, supp_chwidth and ext_nss_bw_supp — and ultimately ni->ni_chw — entirely from ni->ni_vhtcaps, the AP's advertised capability. It never intersects any of them with ic->ic_vhtcaps, ours.

The driver populates its own caps correctly — hal_iwm/mac80211.cpp only adds IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_160MHZ when sc->sc_nvm.vht160_supported is set. Those caps are simply never consulted when the width is chosen.

Every iwm-generation part is 80 MHz max (7265, 8260, 8265). Associating one with an AP that advertises 160 MHz / 80+80 programs a PHY context the firmware cannot execute:

ieee80211_vht_negotiate chan_width=160 support_160=1 support_80_80=1
ieee80211_sta_set_rx_nss ni_rx_nss: 4
iwm_run -> iwm_phy_ctxt_cmd
Start Error Log Dump: Status: 0x79
0x000014FC | ADVANCED_SYSASSERT
could not update PHY context (error 35)
failed to update PHY

The device then resets and re-associates in a loop, so the link never comes up. Authentication and association themselves succeed — ieee80211_recv_assoc_resp is reached — the failure is purely in programming the negotiated width.

Evidence that the AP is not at fault

Same machine, same card, same BSSID, minutes apart, under Linux iwlwifi:

Connected to xx:xx:xx:xx:xx:xx   SSID: <redacted>   freq: 5560.0   (ch 112)
rx bitrate: 325.0 MBit/s VHT-MCS 7 80MHz short GI VHT-NSS 1
tx bitrate: 866.7 MBit/s VHT-MCS 9 80MHz short GI VHT-NSS 2
signal: -45 dBm      — zero iwlwifi errors

Linux performs the intersection in ieee80211_vht_cap_ie_to_sta_vht_cap() and lands on 80 MHz / NSS 2 against the very BSS that asserts here.

Fix

Clamp ni->ni_chw to ic_vhtcaps after the width switch. Cards that genuinely support 160 MHz are unaffected — the clamp only fires when our own caps say we cannot do the width the AP asked for.

Testing

Intel Wireless-AC 7265 (8086:095A), macOS 26.6.2 (Darwin 25.6.0), built from 53c51c2. AP advertising 160 MHz on DFS channel 112.

	before	after
vht_negotiate chan_width	160	80
ADVANCED_SYSASSERT	4 of 4 association attempts	0
failed to update PHY	4	0
association	never completes, resets in a loop	en0 associated with a DHCP lease

Notes for reviewers

• Deliberately not gated on _OSI("Darwin") or on any hal — the intersection is correct for every card and every OS.
• ieee80211_sta_set_rx_nss() has the same shape (it reported ni_rx_nss: 4 for a 2x2 part). Left alone here to keep the change minimal; happy to fold in a matching NSS clamp if you'd prefer it in one PR.
• hal_iwx's ItlIwx.cpp sets ic_vhtcaps the same way, so AX parts get the same protection for free without behaviour change.
• Possibly related, but not claimed as fixed: Killer(R) Wi-Fi 6 AX1650s 160MHz unstable 5GHz performance #850 (AX1650s unstable at 160 MHz — the inverse case, a card that does support the width).

Opened as a draft for review.