brcmsmac: fix bounds checking in tx/rx