measurement: is_meas_complete(): fix fn_mod variable type
`fn_mod` was declared as 'unsigned int' but initialized to -1, which yields `UINT_MAX` via implicit conversion. Use 'int' instead to make the sentinel value unambiguous and match the `%d` format used in the debug log.
The function is declared `bool` but returns `-EINVAL` on an error path. `-EINVAL` is `-22`, which in C implicitly converts to `bool true`. Returning `false` makes more sense when we don't know the MF layout.
Both functions were writing into the same static buffer, so any caller holding a pointer returned by one and then invoking the other would silently end up with a stale/overwritten string. Move name_buf into each function as a local static, so the two buffers are independent.
tx_power: get_pa_drive_level_mdBm(): assert on out-of-range ARFCN
The function previously returned `INT_MIN` as an error sentinel when the ARFCN exceeded the calibration table size (1024 entries, covering all valid GSM ARFCNs 0..1023). None of the callers checked for this value, so it would silently propagate through power calculations and eventually be passed to `bts_model_change_power()`.
An out-of-range ARFCN indicates a serious misconfiguration; replace the range check and `return INT_MIN` with an `OSMO_ASSERT`.
osmo-bts-trx: check sscanf() result in NOMTXPOWER/SETPOWER handlers
Both trx_ctrl_rx_rsp_nomtxpower() and trx_ctrl_rx_rsp_setpower() were calling sscanf() without checking its return value. On a parse failure the local variable remained uninitialized and was passed directly to the callback, resulting in a garbage power level.
The function accesses msg->data[0..4] without first verifying that the message is at least 5 bytes long, which would cause a buffer over-read on a malformed (too short) LAPDm frame.
tch: fix RTP clock not ticking for unhandled payload types
When the payload type from the DSP is not handled by the switch in l1if_tch_rx(), rmsg stays NULL and we return 0 without calling add_l1sap_header(), silently dropping a 20ms RTP tick.
Always allocate an empty RTP frame when rmsg is NULL so the RTP clock keeps ticking.
