wifi: mt76: free pending offchannel tx frames on wcid cleanup

jira KERNEL-238
Rebuild_History Non-Buildable kernel-6.12.0-124.16.1.el10_1
commit-author Felix Fietkau <nbd@nbd.name>
commit bdeac78

Avoid leaking them or keeping the wcid on the tx list

Fixes: 0b3be9d ("wifi: mt76: add separate tx scheduling queue for off-channel tx")
Link: https://patch.msgid.link/20250827085352.51636-5-nbd@nbd.name
	Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit bdeac78)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

Author: PlaidCat

drivers/net/wireless/mediatek/mt76/mac80211.c

@@ -1677,6 +1677,10 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
 	skb_queue_splice_tail_init(&wcid->tx_pending, &list);
 	spin_unlock(&wcid->tx_pending.lock);
 
+	spin_lock(&wcid->tx_offchannel.lock);
+	skb_queue_splice_tail_init(&wcid->tx_offchannel, &list);
+	spin_unlock(&wcid->tx_offchannel.lock);
+
 	spin_unlock_bh(&phy->tx_lock);
 
 	while ((skb = __skb_dequeue(&list)) != NULL) {