net80211: fix TKIP trailer trimming w/ no rx parameters given

Previous work made trimming the TKIP trailer an optional thing
based on what the driver indicated it did with the received
frame.  However, for drivers that aren't populating an RX frame
with an rx status - notably iwn(4) - exposed this bug.

If the driver doesn't expose any RX status then just restore
the previous behaviour.

This matches what was done in the CCMP code in ccmp_decap().

Locally tested:

* iwn(4), STA mode, CCMP + TKIP groupwise network

Differential Revision:	https://reviews.freebsd.org/D50638
Fixes:	731ff40069
MFC after:	3 days
Reviewed by:	bz

sys/net80211/ieee80211_crypto_tkip.c

@@ -370,7 +370,7 @@ tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
 	/*
 	 * Strip the ICV if hardware has not done so already.
 	 */
-	if (rxs != NULL && (rxs->c_pktflags & IEEE80211_RX_F_ICV_STRIP) == 0)
+	if ((rxs == NULL) || (rxs->c_pktflags & IEEE80211_RX_F_ICV_STRIP) == 0)
 		m_adj(m, -tkip.ic_trailer);
 
 	return 1;