
<     read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr);
---
>     read_ptr = iwl_txq_get_safe_cmd_index(txq, txq->read_ptr, txq->n_entries);
