rwnx_cfg80211_scan() stores the request in rwnx_hw->scan_request before sending SCANU_START_REQ. When the send
fails, the error goes back to cfg80211, which frees the request, but scan_request still points at it. A late
SCANU_START_CFM (or the next scan's completion) then calls cfg80211_scan_done() on freed memory.
Seen on an AIC8800DC with a command timeout injected during a scan: the kernel panicked in cfg80211_scan_done(),
caught twice on the serial console.
Without WIPHY_FLAG_NETNS_OK, 'iw phy <phy> set netns' is refused, so the
interface can't be used from a namespace (as test rigs do to pair two radios
in one box). The driver keeps nothing per namespace: its only uses of
init_net are its own netlink control socket and an optional bridge lookup.
nomdetom