Various iwn(4) fixes.

Various iwn(4) fixes.

* simplify channel logic for determining RF gain setting in scan setup
* don't set TX timer on error
* free node references for unsent frames on device stop
* set maxfrags to IWN_MAX_SCATTER-1 (first segment is used by TX command)
* add missing IWN_UNLOCK() from interrupt path when the hardware
  disappears.
* pass control frames to host
* nitems() instead of local macro

Tested:

* Intel 5100, STA mode

PR:		kern/196264
Submitted by:	Andriy Voskoboinyk <s3erios@gmail.com>