There's a race during beacon setup and VAP setup/interface up that
is easily triggered by configuring AP interfaces in rc.conf and letting
the rc system bring things up.
ic->ic_curchan has a channel (which is a legacy hold over anyway),
but ni->ni_chan is set to IEEE80211_CHAN_ANYC. So, the BSS stuff
is (surprise!) not quite setup by the time the newstate path is
run (newstate_cb -> ath_newstate into RUN state -> ath_beacon_alloc()
-> ieee80211_beacon_alloc() -> ieee80211_beacon_construct() ->
ieee80211_getcapinfo()) and things explode.
This is definitely the wrong place to solve this problem though,
and when it's actually solved, a KASSERT belongs here instead.
In the meantime, this will just set up an incomplete capinfo field
until the next beacon update, at which point there'll (hopefully!) be
a valid BSS ni->ni_chan.