iwm(4): Fix off-by-one error in a range check in iwm_read_firmware().

[Imre Vadasz]

This fixes an off-by-one error in the
"if (idx > howmany(IWM_NUM_UCODE_TLV_CAPA, 32))" range check.
Since IWM_NUM_UCODE_TLV_CAPA is defined as 128, for an idx value of 4,
we would potentially try to set bits 159..128 in the sc->sc_enabled_capa
bitmap (which is just IWM_NUM_UCODE_TLV_CAPA bits long).

Index: sys/dev/pci/if_iwm.c
===================================================================
RCS file: /cvs/src/sys/dev/pci/if_iwm.c,v
retrieving revision 1.99
diff -u -r1.99 if_iwm.c
--- sys/dev/pci/if_iwm.c        17 Aug 2016 09:39:38 -0000      1.99
+++ sys/dev/pci/if_iwm.c        31 Aug 2016 19:41:12 -0000
@@ -758,7 +758,7 @@
                        }
                        capa = (struct iwm_ucode_capa *)tlv_data;
                        idx = le32toh(capa->api_index);
-                       if (idx > howmany(IWM_NUM_UCODE_TLV_CAPA, 32)) {
+                       if (idx >= howmany(IWM_NUM_UCODE_TLV_CAPA, 32)) {
                                DPRINTF(("%s: unsupported API index %d\n",
                                    DEVNAME(sc), idx));
                                goto parse_out;