bwn BCM43224 (MacBook Air A1370) driver fixes for FreeBSD 15.1

Patches + build scripts + firmware sources to make the Broadcom BCM43224
(PCI 0x14e4:0x4353, subvendor 0x106b:0x00d1) work on FreeBSD 15.1.

Fixes:
- Fix 1: compile GPL N-PHY code (BWN_GPL_PHY build wiring)
- Fix 2: NULL-guard bwn_dma_ringfree on partial attach
- Fix 3: wire bwn_update_mcast to ic->ic_update_mcast
- Fix 5: load bwn_v4_n firmware at loader stage (loader.conf)
- Fix 6: reclaim pending TX frames at bwn_dma_stop (detach double-free)
- Fix 7: driver-owned node ref + remove dr_usedslot early-return +
        bhndb_pci BHNDB_PCI_QUIRK_NO_MSI for BCM43224 (legacy INTx)
- Fix 8: restrict reclaim to TX rings only (RX reclaim caused heap
        corruption / TCP panic)

README.md  = rebuild guide (apply.sh + build.sh, manual steps)
RESEARCH.md = root-cause investigation log (Fixes 5-8)

patches/patch-bhndb_pci.c

@@ -0,0 +1,35 @@
+diff --git a/sys/dev/bhnd/bhndb/bhndb_pci.c b/sys/dev/bhnd/bhndb/bhndb_pci.c
+index 0cdcba1d..7b6ae0f3 100644
+--- a/sys/dev/bhnd/bhndb/bhndb_pci.c
++++ b/sys/dev/bhnd/bhndb/bhndb_pci.c
+@@ -195,6 +195,16 @@ static struct bhndb_pci_quirk bhndb_pci_quirks[] = {
+ static struct bhndb_pci_quirk bhndb_pcie_quirks[] = {
+ 	/* All PCIe-G1 core revisions require the SRSH work-around */
+ 	BHNDB_PCI_QUIRK(HWREV_ANY,	BHNDB_PCI_QUIRK_SRSH_WAR),
++
++	/*
++	 * BCM43224 (and other Broadcom PCIe-G1 endpoints) do not have MSI
++	 * delivered on some host platforms (e.g. NVIDIA MCP89 based Apple
++	 * MacBook Air); force legacy INTx instead.
++	 */
++	{ { BHND_MATCH_CHIP_ID(BCM43224) },
++	  { BHND_MATCH_ANY },
++	  BHNDB_PCI_QUIRK_NO_MSI },
++
+ 	BHNDB_PCI_QUIRK_END
+ };
+ 
+@@ -327,6 +337,13 @@ bhndb_pci_alloc_msi(struct bhndb_pci_softc *sc, int *msi_count)
+ {
+ 	int error, count;
+ 
++	/* MSI disabled by bridge quirk? */
++	if (sc->pci_quirks & BHNDB_PCI_QUIRK_NO_MSI) {
++		device_printf(sc->dev, "MSI disabled by quirk; using INTx on "
++		    "%s\n", device_get_nameunit(sc->parent));
++		return (ENXIO);
++	}
++
+ 	/* Is MSI available? */
+ 	if (pci_msi_count(sc->parent) < BHNDB_PCI_MSI_COUNT)
+ 		return (ENXIO);