bwn BCM43224 (MacBook Air A1370) driver fixes for FreeBSD 15.1

Patches + build scripts + firmware sources to make the Broadcom BCM43224
(PCI 0x14e4:0x4353, subvendor 0x106b:0x00d1) work on FreeBSD 15.1.

Fixes:
- Fix 1: compile GPL N-PHY code (BWN_GPL_PHY build wiring)
- Fix 2: NULL-guard bwn_dma_ringfree on partial attach
- Fix 3: wire bwn_update_mcast to ic->ic_update_mcast
- Fix 5: load bwn_v4_n firmware at loader stage (loader.conf)
- Fix 6: reclaim pending TX frames at bwn_dma_stop (detach double-free)
- Fix 7: driver-owned node ref + remove dr_usedslot early-return +
        bhndb_pci BHNDB_PCI_QUIRK_NO_MSI for BCM43224 (legacy INTx)
- Fix 8: restrict reclaim to TX rings only (RX reclaim caused heap
        corruption / TCP panic)

README.md  = rebuild guide (apply.sh + build.sh, manual steps)
RESEARCH.md = root-cause investigation log (Fixes 5-8)

apply.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+# Apply the bwn BCM43224 (Apple MacBook Air A1370) patches to a clean
+# FreeBSD 15.1 source tree. Idempotent: it skips any patch that is already
+# applied.
+#
+# Usage: sudo ./apply.sh [SRC_ROOT]
+# Default SRC_ROOT=/usr/src
+#
+# The patches:
+#   patches/patch-if_bwn.c       - driver fixes (Fixes 1-4, 6-8)
+#   patches/patch-Makefile       - GPL PHY build wiring (Fix 1)
+#   patches/patch-bhndb_pci.c    - NO_MSI quirk for BCM43224 (Fix 7)
+#   patches/patch-bhndb_pcivar.h - NO_MSI quirk definition (Fix 7)
+set -e
+SRC="${1:-/usr/src}"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+
+if [ ! -f "$SRC/sys/dev/bwn/if_bwn.c" ]; then
+	echo "ERROR: $SRC/sys/dev/bwn/if_bwn.c not found." >&2
+	echo "       Point SRC_ROOT at a FreeBSD 15.1 src tree (e.g. /usr/src)." >&2
+	exit 1
+fi
+
+echo "Applying patches into: $SRC"
+for p in patch-if_bwn.c patch-Makefile patch-bhndb_pci.c patch-bhndb_pcivar.h; do
+	if (cd "$SRC" && patch -p1 -N --dry-run < "$HERE/patches/$p" >/dev/null 2>&1); then
+		(cd "$SRC" && patch -p1 -N < "$HERE/patches/$p")
+		echo "  applied $p"
+	else
+		echo "  skip $p (already applied or not applicable)"
+	fi
+done
+echo "Done. Source patched. Now run ./build.sh (or 'make' in sys/modules/bwn)."