Two independent bugs in the block ack teardown paths, both found by code
inspection on next-20260825 and compile tested only.

The first leaves nxpwifi_11n_delete_tx_ba_stream_tbl_entry() unable to
delete anything, so Tx BA stream entries leak on every teardown and
aggregation eventually stops being negotiated. The second holds the RCU
read lock across a teardown that sleeps, which splats under
CONFIG_DEBUG_ATOMIC_SLEEP when a station deauthenticates from the AP.

David Carlier (2):
  wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion
  wifi: nxpwifi: do not delete Rx reorder entries under RCU

 drivers/net/wireless/nxp/nxpwifi/11n.c           |  2 +-
 drivers/net/wireless/nxp/nxpwifi/11n_rxreorder.c | 11 ++++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

-- 
2.55.0