bwn BCM43224 (MacBook Air A1370) driver fixes for FreeBSD 15.1

Patches + build scripts + firmware sources to make the Broadcom BCM43224
(PCI 0x14e4:0x4353, subvendor 0x106b:0x00d1) work on FreeBSD 15.1.

Fixes:
- Fix 1: compile GPL N-PHY code (BWN_GPL_PHY build wiring)
- Fix 2: NULL-guard bwn_dma_ringfree on partial attach
- Fix 3: wire bwn_update_mcast to ic->ic_update_mcast
- Fix 5: load bwn_v4_n firmware at loader stage (loader.conf)
- Fix 6: reclaim pending TX frames at bwn_dma_stop (detach double-free)
- Fix 7: driver-owned node ref + remove dr_usedslot early-return +
        bhndb_pci BHNDB_PCI_QUIRK_NO_MSI for BCM43224 (legacy INTx)
- Fix 8: restrict reclaim to TX rings only (RX reclaim caused heap
        corruption / TCP panic)

README.md  = rebuild guide (apply.sh + build.sh, manual steps)
RESEARCH.md = root-cause investigation log (Fixes 5-8)

build.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# Build and install the patched bwn driver (if_bwn.ko), the patched PCIe
+# bridge (bhndb_pci.ko) and the Broadcom v4 firmware (bwn_v4_n.ko) on a
+# clean FreeBSD 15.1 system.
+#
+# Usage: sudo ./build.sh [SRC_ROOT]
+# Default SRC_ROOT=/usr/src
+#
+# What it does:
+#   1. Builds if_bwn.ko   (sys/modules/bwn)        -> /boot/modules/if_bwn.ko
+#   2. Builds bhndb_pci.ko(sys/modules/bhnd/bhndb_pci) -> /boot/kernel/bhndb_pci.ko
+#   3. Builds bwn_v4_n.ko (src/firmware)          -> /boot/modules/bwn_v4_n.ko
+#   4. Adds "bwn_v4_n_load=YES" to /boot/loader.conf (Fix 5) if missing.
+#
+# All changes take effect on the NEXT reboot (modules are only loaded at
+# boot). The running kernel is NOT touched, so an active SSH session (e.g.
+# over the fallback rtwn0/wlan0 interface) is never disrupted by this script.
+#
+# After reboot, bwn0 attaches on the BCM43224 and uses legacy INTx (the
+# NO_MSI quirk), so TX interrupts are delivered and the "device timeout" /
+# detach-panic / heap-corruption issues are resolved.
+set -e
+SRC="${1:-/usr/src}"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+
+if [ ! -d "$SRC/sys" ]; then
+	echo "ERROR: $SRC/sys not found. Point SRC_ROOT at a FreeBSD 15.1 src tree." >&2
+	exit 1
+fi
+
+echo "==> [1/3] Building if_bwn.ko"
+make -C "$SRC/sys/modules/bwn" SRCTOP="$SRC" SYSDIR="$SRC/sys" clean
+make -C "$SRC/sys/modules/bwn" SRCTOP="$SRC" SYSDIR="$SRC/sys"
+install -m 444 -o root -g wheel "$SRC/sys/modules/bwn/if_bwn.ko" /boot/modules/if_bwn.ko
+sync
+echo "    -> /boot/modules/if_bwn.ko"
+
+echo "==> [2/3] Building bhndb_pci.ko (NO_MSI quirk)"
+make -C "$SRC/sys/modules/bhnd/bhndb_pci" SRCTOP="$SRC" SYSDIR="$SRC/sys" clean
+make -C "$SRC/sys/modules/bhnd/bhndb_pci" SRCTOP="$SRC" SYSDIR="$SRC/sys"
+install -m 444 -o root -g wheel "$SRC/sys/modules/bhnd/bhndb_pci/bhndb_pci.ko" /boot/kernel/bhndb_pci.ko
+sync
+echo "    -> /boot/kernel/bhndb_pci.ko"
+
+echo "==> [3/3] Building + installing bwn_v4_n.ko (firmware)"
+make -C "$HERE/src/firmware" SRCTOP="$SRC" SYSDIR="$SRC/sys" clean
+make -C "$HERE/src/firmware" SRCTOP="$SRC" SYSDIR="$SRC/sys"
+install -m 444 -o root -g wheel "$HERE/src/firmware/bwn_v4_n.ko" /boot/modules/bwn_v4_n.ko
+sync
+echo "    -> /boot/modules/bwn_v4_n.ko"
+
+echo "==> Adding firmware load to /boot/loader.conf (Fix 5)"
+if ! grep -q 'bwn_v4_n_load="YES"' /boot/loader.conf 2>/dev/null; then
+	cp /boot/loader.conf "$HERE/rc.conf.backups/loader.conf.before_build_$(date +%Y%m%d%H%M%S)"
+	printf '\n# bwn driver: load Broadcom v4 firmware at loader time (Fix 5)\nbwn_v4_n_load="YES"\n' >> /boot/loader.conf
+	echo "    added bwn_v4_n_load=YES"
+else
+	echo "    already present, skipped"
+fi
+
+echo
+echo "==> All modules built and installed. REBOOT to activate."
+echo "    After reboot, create the interface with:"
+echo "        ifconfig wlan create wlandev bwn0 [wap]"