A keen eye found an out-of-bounds read in the RSSI calibration code. The firmware was using the battery calibration values for bands above 174MHz. This may explain differences in sensitivity found in other firmware forks.

GCC didn't flag this as an issue. We don't use clang but I don't think it flagged it either when I added support for it.