The function is declared `bool` but returns `-EINVAL` on an error path. `-EINVAL` is `-22`, which in C implicitly converts to `bool true`. Returning `false` makes more sense when we don't know the MF layout.
Both functions were writing into the same static buffer, so any caller holding a pointer returned by one and then invoking the other would silently end up with a stale/overwritten string. Move name_buf into each function as a local static, so the two buffers are independent.
tx_power: get_pa_drive_level_mdBm(): assert on out-of-range ARFCN
The function previously returned `INT_MIN` as an error sentinel when the ARFCN exceeded the calibration table size (1024 entries, covering all valid GSM ARFCNs 0..1023). None of the callers checked for this value, so it would silently propagate through power calculations and eventually be passed to `bts_model_change_power()`.
An out-of-range ARFCN indicates a serious misconfiguration; replace the range check and `return INT_MIN` with an `OSMO_ASSERT`.
osmo-bts-trx: check sscanf() result in NOMTXPOWER/SETPOWER handlers
Both trx_ctrl_rx_rsp_nomtxpower() and trx_ctrl_rx_rsp_setpower() were calling sscanf() without checking its return value. On a parse failure the local variable remained uninitialized and was passed directly to the callback, resulting in a garbage power level.
The function accesses msg->data[0..4] without first verifying that the message is at least 5 bytes long, which would cause a buffer over-read on a malformed (too short) LAPDm frame.
