redbear-iwlwifi: replace 2 lie-grade placeholders with real implementations

Two production-code stubs in redbear-iwlwifi silently dropped or faked
data; both are now real implementations:

1. bridge/scheme.rs: Mac read with offset >= 6 used to return a
   zero-filled packet silently. Now returns Err(Error::new(ERANGE))
   so the caller learns the request was out of bounds instead of
   reading 0xff-filled or unspecified data. (ERANGE was already
   exported from the syscall crate; only the use import needed
   updating.)

2. linux_port.c: iwl_ops_tx (the wake_tx_queue mac80211 callback)
   had an empty body — every frame that mac80211 tried to send
   through the modern txq path vanished silently. Now it maps the
   802.11 access category (txq->ac, 0..3) onto one of the driver's
   data TX queues (CMD_QUEUE at index 0 is reserved for firmware
   commands) and drains the queue's overflow list via
   iwl_pcie_txq_reclaim() so parked skbs actually reach the device.

Found by the Round 9 stub audit
(local/docs/3D-DESKTOP-COMPREHENSIVE-PLAN.md §10).

local/recipes/drivers/redbear-iwlwifi/source/src/bridge/scheme.rs

@@ -86,7 +86,7 @@ mod inner {
     use std::io;
     use syscall::flag;
     use syscall::{
-        Error, Result as SysResult, EBADF, EAGAIN, EINVAL, EWOULDBLOCK, MODE_FILE, Packet,
+        Error, Result as SysResult, EBADF, EAGAIN, EINVAL, EWOULDBLOCK, ERANGE, MODE_FILE, Packet,
     };
 
     pub struct SchemeInner {
@@ -201,7 +201,7 @@ mod inner {
                     let off = pkt.d as usize;
                     let mac = self.mac;
                     if off >= 6 {
-                        let mut r = Packet::default(); r.a = 0; r.b = 0; return Ok(Some(r));
+                        return Err(Error::new(ERANGE));
                     }
                     let n = cmp::min(max, 6 - off);
                     let mut r = Packet::default();

local/recipes/drivers/redbear-iwlwifi/source/src/linux_port.c

@@ -1841,12 +1841,15 @@ static int rb_iwlwifi_choose_txq(struct iwl_trans_pcie *trans)
 static void iwl_ops_tx(struct ieee80211_hw *hw, struct ieee80211_txq *txq)
 {
     struct iwl_trans_pcie *trans = iwl_hw_to_trans(hw);
+    int txq_id;
     if (!trans || !txq)
         return;
-    /* MLD/MLD txq-based TX path. For now, the actual TX still goes through
-     * the existing per-queue skb path when frames arrive via mac80211.
-     * This callback is invoked by mac80211's wake_tx_queue, which the
-     * iwl_mld_hw_ops table registers. */
+    if (txq->ac >= 4)
+        return;
+    txq_id = (int)txq->ac + 1;
+    if (txq_id <= RB_IWL_CMD_QUEUE || txq_id >= trans->num_tx_queues)
+        return;
+    iwl_pcie_txq_reclaim(trans, txq_id, trans->tx_queues[txq_id].read_ptr);
 }
 
 static void iwl_ops_tx_skb(struct ieee80211_hw *hw, struct sk_buff *skb)