My understanding is that 'match', is allocated by :
match = kzalloc(struct_size(match, channels, n_channels), GFP_KERNEL);
So match->n_channels is *0* when iwl_mvm_query_set_freqs() is called.
n_channels is updated in the line before calling kzalloc():
n_channels = iwl_mvm_query_num_match_chans(mvm, d3_data->nd_results, i);
match = kzalloc(struct_size(match, channels, n_channels), GFP_KERNEL);