iwl_mvm_window_status_notif() extracts a 5-bit station ID from the
firmware's BA-window status notification (values up to 31) and indexes
mvm->fw_id_to_mac_id[] with it without first checking it against the
firmware's station capacity. A firmware/backend notification carrying an
out-of-range ID reads past the station map.

Patch 1 validates the station ID against mvm->fw->ucode_capa.num_stations
before the lookup, matching the existing MVM station-lookup helpers. Patch
2 adds KUnit coverage: the malformed out-of-range ID and a valid-ID/
null-station control that must still pass.

Reproduced with the KUnit test under UBSAN bounds: the malformed case
reports an array-index-out-of-bounds splat on stock and passes after the
fix; the valid-ID control passes on both.

Cc: stable@vger.kernel.org

Michael Bommarito (2):
  wifi: iwlwifi: mvm: check BA-window station ID before lookup
  wifi: iwlwifi: mvm: add KUnit coverage for BA-window station ID bounds

 drivers/net/wireless/intel/iwlwifi/mvm/rx.c   |  4 +
 .../wireless/intel/iwlwifi/mvm/tests/Makefile |  2 +-
 .../intel/iwlwifi/mvm/tests/window-status.c   | 77 +++++++++++++++++++
 3 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c

--
2.53.0