ath9k_reg_rmw_buffer() flushes the buffer when it is full, but sizes
the WMI command with sizeof(struct register_write), which is 8 bytes.
The buffer holds struct register_rmw entries, which are 12 bytes. For
the 15 entries of a full buffer the firmware receives 120 bytes instead
of 180 and applies only the first 10 read-modify-writes.

ath9k_reg_rmw_flush() already uses the correct size. Use it in the
full-buffer path as well.

No current caller fills the buffer; ath9k_hw_4k_set_gain() comes
closest with 14 entries. The first caller to queue a 15th entry loses
its last five writes without any error, which is why this is worth
having in stable trees before one appears.

Fixes: 8badb50cfab6 ("ath9k_htc: add new WMI_REG_RMW_CMDID command")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Nerijus Bendžiūnas <nerijus.bendziunas@gmail.com>
---
Changes in v2:
- Add Assisted-by, rewrite the commit message, rebase onto ath-next. No
  code change.

 drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 6de78ae85726..0b49d2cc99f0 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void *hw_priv,
 	if (priv->wmi->multi_rmw_idx == MAX_RMW_CMD_NUMBER) {
 		r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID,
 			  (u8 *) &priv->wmi->multi_rmw,
-			  sizeof(struct register_write) * priv->wmi->multi_rmw_idx,
+			  sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx,
 			  (u8 *) &rsp_status, sizeof(rsp_status),
 			  100);
 		if (unlikely(r)) {

base-commit: 1d8e73163ef933624341075f576e2f36ef9133f7
-- 
2.55.0

Please do not apply this patch, and do not send it to stable.

The message is wrong: ar9271_hw_pa_cal() does fill the buffer, with
exactly 15 entries, on every AR9271 reset.

With the size fixed the command is 8 (HTC) + 4 (WMI) + 180 = 192
bytes, three full 64-byte USB packets. The firmware ends a command
only on a short packet, so this one never ends. The next command is
glued to it and the device is dead until power-cycled. An AR9271 hangs
this way on the first interface open.

A v3 follows in a new thread: the size fix plus a cap of 14 entries,
so the buffer can never produce a 192-byte command.

Nerijus