rwnx_cfg80211_scan() stores the request in rwnx_hw->scan_request before sending SCANU_START_REQ. When the send
fails, the error goes back to cfg80211, which frees the request, but scan_request still points at it. A late
SCANU_START_CFM (or the next scan's completion) then calls cfg80211_scan_done() on freed memory.
Seen on an AIC8800DC with a command timeout injected during a scan: the kernel panicked in cfg80211_scan_done(),
caught twice on the serial console.
