bwn BCM43224 (MacBook Air A1370) driver fixes for FreeBSD 15.1

Patches + build scripts + firmware sources to make the Broadcom BCM43224
(PCI 0x14e4:0x4353, subvendor 0x106b:0x00d1) work on FreeBSD 15.1.

Fixes:
- Fix 1: compile GPL N-PHY code (BWN_GPL_PHY build wiring)
- Fix 2: NULL-guard bwn_dma_ringfree on partial attach
- Fix 3: wire bwn_update_mcast to ic->ic_update_mcast
- Fix 5: load bwn_v4_n firmware at loader stage (loader.conf)
- Fix 6: reclaim pending TX frames at bwn_dma_stop (detach double-free)
- Fix 7: driver-owned node ref + remove dr_usedslot early-return +
        bhndb_pci BHNDB_PCI_QUIRK_NO_MSI for BCM43224 (legacy INTx)
- Fix 8: restrict reclaim to TX rings only (RX reclaim caused heap
        corruption / TCP panic)

README.md  = rebuild guide (apply.sh + build.sh, manual steps)
RESEARCH.md = root-cause investigation log (Fixes 5-8)

patches/patch-Makefile

@@ -0,0 +1,47 @@
+diff --git a/sys/modules/bwn/Makefile b/sys/modules/bwn/Makefile
+index 37c7b35d..962aa268 100644
+--- a/sys/modules/bwn/Makefile
++++ b/sys/modules/bwn/Makefile
+@@ -24,15 +24,33 @@ SRCS+=	bhndb_bus_if.h \
+ # Other
+ SRCS+=	device_if.h bus_if.h gpio_if.h pci_if.h opt_bwn.h opt_wlan.h
+ 
+-# The following need the BWN_GPL_PHY kenrel option to opt-in
+-# to the GPL'd 802.11n PHY support for this driver.
++# BWN_GPL_PHY: enable GPLv2 802.11n PHY support (required for N-PHY chips like BCM43224).
++# Without this, bwn(4) attaches but bwn_phy_n_attach() fails with:
++#   "BWN_GPL_PHY not in kernel config; no PHY-N support".
++# NOTE: We define it here (not via the kernel config) because this is a
++# standalone module build; bsd.kmod.mk only honours SRCS.<OPT> when <OPT> is
++# present in KERN_OPTS, which it is not for out-of-tree module builds.
++opt_bwn.h:
++	@echo "#define BWN_GPL_PHY 1" > ${.TARGET}
++
++# The following are the GPL'd 802.11n PHY support files for this driver.
++# They MUST be added unconditionally to SRCS (not via SRCS.BWN_GPL_PHY),
++# because a standalone module build does not populate KERN_OPTS with
++# BWN_GPL_PHY, so the SRCS.<OPT> mechanism would skip them entirely.
+ .PATH: ${SRCTOP}/sys/gnu/dev/bwn/phy_n
+-SRCS.BWN_GPL_PHY+=  if_bwn_radio_2055.c
+-SRCS.BWN_GPL_PHY+=  if_bwn_radio_2056.c
+-SRCS.BWN_GPL_PHY+=  if_bwn_radio_2057.c
+-SRCS.BWN_GPL_PHY+=  if_bwn_phy_n_sprom.c
+-SRCS.BWN_GPL_PHY+=  if_bwn_phy_n_tables.c
+-SRCS.BWN_GPL_PHY+=  if_bwn_phy_n_ppr.c
+-SRCS.BWN_GPL_PHY+=  if_bwn_phy_n_core.c
++SRCS+=  if_bwn_radio_2055.c
++SRCS+=  if_bwn_radio_2056.c
++SRCS+=  if_bwn_radio_2057.c
++SRCS+=  if_bwn_phy_n_sprom.c
++SRCS+=  if_bwn_phy_n_tables.c
++SRCS+=  if_bwn_phy_n_ppr.c
++SRCS+=  if_bwn_phy_n_core.c
+ 
+ .include <bsd.kmod.mk>
++
++# Temporary debug build
++CFLAGS+= -DBWN_DEBUG
++CFLAGS+= -DBWN_DEBUG
++
++# Temporary debug build
++CFLAGS+= -DBWN_DEBUG