mt76: add sanity check for a-mpdu rx wcid index

Avoid dereferencing invalid ids
Signed-off-by: Felix Fietkau <nbd@nbd.name>

drivers/net/wireless/mediatek/mt76/mac80211.c

@@ -644,7 +644,7 @@ mt76_airtime_flush_ampdu(struct mt76_dev *dev)
 		return;
 
 	wcid_idx = dev->rx_ampdu_status.wcid_idx;
-	if (dev->rx_ampdu_status.wcid_idx != 0xff)
+	if (wcid_idx < ARRAY_SIZE(dev->wcid))
 		wcid = rcu_dereference(dev->wcid[wcid_idx]);
 	else
 		wcid = NULL;