Bug 2537645

Description of problem:
After updating linux-firmware from 20260309 to 20260916, the mt7921e WiFi
driver crashes on every boot with a UBSAN array-index-out-of-bounds error,
causing the wireless interface to fail to initialize properly. This leads
to repeated system instability and, in my case, unrelated services (Docker
containers) failing to start cleanly due to the resulting reboot cycles.

Version-Release number of selected component (if applicable):
linux-firmware-20260916-1.fc44.noarch
kernel-7.2.5-200.fc44.x86_64

How reproducible:
Always, on every boot with linux-firmware-20260916 installed.

Steps to Reproduce:
1. Install/update to linux-firmware-20260916-1.fc44 on a system with an
   MT7921/MT7922 wireless card
2. Boot the system
3. Check dmesg / journalctl for kernel errors

Actual results:
kernel: UBSAN: array-index-out-of-bounds in
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:471:15
kernel: index 3 is out of range for type 'void *[3]'

Expected results:
WiFi card initializes without triggering a kernel-level array bounds
violation.

Additional info:
This appears to be caused by the linux-firmware 20260916 package shipping
an updated CLC (Country Location Control) firmware blob that includes a
new section with idx=3, while the in-kernel mt7921 driver only allocates
space for 3 entries (idx 0-2, MT792x_CLC_MAX_NUM). The driver does not
validate the idx value read from the firmware blob before using it to
index phy->clc[], resulting in an out-of-bounds array access.

This exact issue was already identified and fixed upstream:

  Patch: "wifi: mt76: mt7921: validate CLC indices"
  Author: Zhao Li
  Date: 2026-07-31
  Link: https://git.kernel.org/linus/9679ca7326e52282cc923c4d71d81c999cb6cd55

A related fix for the mt7925 variant was merged earlier:
  "wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc"
  https://github.com/torvalds/linux/commit/9679ca7326e52282cc923c4d71d81c999cb6cd55

Workaround:
Downgrading to linux-firmware-20260309-1.fc44 (the version prior to the
CLC firmware update) resolves the issue completely - no more UBSAN errors
on boot, WiFi initializes cleanly.

  sudo dnf downgrade linux-firmware-20260309-1.fc44 --allowerasing
  sudo dnf versionlock add linux-firmware-20260309-1.fc44

Requesting either:
1. The mt7921 kernel driver in the Fedora kernel package be updated to
   include the upstream CLC index validation fix, or
2. The linux-firmware package be reverted/patched until the kernel-side
   fix is in place, to avoid shipping a firmware/driver combination known
   to crash on boot.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.1. Install/update to linux-firmware-20260916-1.fc44 on a system with an MT7921/MT7922 wireless card
2. Boot the system
3. Check dmesg / journalctl for kernel errors
Actual Results:
kernel: UBSAN: array-index-out-of-bounds in drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:471:15
kernel: index 3 is out of range for type 'void *[3]'

Expected Results:
WiFi card initializes without triggering a kernel-level array bounds violation.

Additional Information:
Version: linux-firmware-20260916-1.fc44.noarch
Kernel: kernel-7.2.5-200.fc44.x86_64

Root cause:
The linux-firmware 20260916 package ships an updated CLC (Country Location
Control) firmware blob with a new section (idx=3), while the in-kernel
mt7921 driver only allocates space for 3 entries (idx 0-2,
MT792x_CLC_MAX_NUM). The driver does not validate the idx value before
using it to index phy->clc[], causing an out-of-bounds array access.

This exact issue was already fixed upstream:
  Patch: "wifi: mt76: mt7921: validate CLC indices"
  Author: Zhao Li
  Date: 2026-07-31
  Link: https://git.kernel.org/linus/9679ca7326e52282cc923c4d71d81c999cb6cd55

Workaround:
Downgrading to linux-firmware-20260309-1.fc44 resolves the issue completely.

  sudo dnf downgrade linux-firmware-20260309-1.fc44 --allowerasing
  sudo dnf versionlock add linux-firmware-20260309-1.fc44