diff
< 	read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr);
---
> 	if (txq->read_ptr < 0 || txq->read_ptr >= TXQ_MAX_SIZE) {
> 		WARN_ON(1); // or handle error appropriately
> 		return;
> 	}
> 	read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr);
