My understanding is that 'match', is allocated by : match = kzalloc(struct_size(match, channels, n_channels), GFP_KERNEL); So match->n_channels is *0* when iwl_mvm_query_set_freqs() is called.
n_channels is updated in the line before calling kzalloc(): n_channels = iwl_mvm_query_num_match_chans(mvm, d3_data->nd_results, i); match = kzalloc(struct_size(match, channels, n_channels), GFP_KERNEL); -- Gustavo