mt7612 crash on 7621

master HEAD build

<1>[37947.153634] CPU 0 Unable to handle kernel paging request at virtual address 0000000c, epc == 80088620, ra == 8008936c
<4>[37947.164253] Oops[#1]:
<4>[37947.166525] CPU: 0 PID: 6036 Comm: kworker/u8:0 Tainted: G         C        5.4.45 #0
<4>[37947.174362] Workqueue: phy1 mt76x02_wdt_work [mt76x02_lib]
<4>[37947.179821] $ 0   : 00000000 00000001 00000000 00000001
<4>[37947.185024] $ 4   : 8e0b26c8 0004f0a8 00000004 00000001
<4>[37947.190225] $ 8   : fefefeff 00000018 80808080 fefefeff
<4>[37947.195427] $12   : 00000000 00000000 00000000 00000000
<4>[37947.200628] $16   : 8e0b26c8 00000008 8e0b2638 8e08c000
<4>[37947.205830] $20   : 00000000 8e0b1e8c 8e0b294c 80690000
<4>[37947.211031] $24   : bc08c42f 036be704                  
<4>[37947.216233] $28   : 8d430000 8d431dd8 8e06d2c0 8008936c
<4>[37947.221436] Hi    : 00000000
<4>[37947.224296] Lo    : 00000000
<4>[37947.227193] epc   : 80088620 hrtimer_active+0x4/0x74
<4>[37947.232134] ra    : 8008936c hrtimer_try_to_cancel+0x10/0xd0
<4>[37947.237761] Status: 11008403	KERNEL EXL IE 
<4>[37947.241925] Cause : 40800008 (ExcCode 02)
<4>[37947.245909] BadVA : 0000000c
<4>[37947.248770] PrId  : 0001992f (MIPS 1004Kc)
<4>[37947.252839] Modules linked in: ksmbd qcserial pppoe ppp_async option l2tp_ppp cdc_mbim usb_wwan sierra_net sierra rndis_host qmi_wwan pptp pppox ppp_mppe ppp_generic mt76x2e mt76x2_common mt76x02_lib mt7603e mt76 mac80211 ipt_REJECT huawei_cdc_ncm cfg80211 cdc_ncm cdc_ether xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_socket xt_recent xt_quota xt_pkttype xt_physdev xt_owner xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_iprange xt_ipp2p xt_iface xt_hl xt_helper xt_hashlimit xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_addrtype xt_TPROXY xt_TCPMSS xt_REDIRECT xt_NETMAP xt_MASQUERADE xt_LOG xt_IPMARK xt_HL xt_DSCP xt_CT xt_CLASSIFY wireguard usbserial usbnet usblp ts_fsm ts_bm slhc sch_cake r8152 nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject_bridge nft_reject nft_redir nft_quota nft_objref nft_numgen nft_meta_bridge nft_log nft_limit nft_hash nft_fwd_netdev nft_dup_netdev nft_ct nft_counter nf_tproxy_ipv6 nf_tproxy_ipv4
<4>[37947.253039]  nf_tables_set nf_tables nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_rtsp nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda nf_log_ipv4 nf_dup_netdev nf_conntrack_tftp nf_conntrack_snmp nf_conntrack_sip nf_conntrack_rtsp nf_conntrack_rtcache nf_conntrack_pptp nf_conntrack_netlink nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack_broadcast ts_kmp nf_conntrack_amanda nf_conncount macvlan iptable_raw iptable_nat iptable_mangle iptable_filter ipt_ah ipt_ECN ipheth ip_tables crc_ccitt compat_xtables compat cdc_wdm br_netfilter asn1_decoder natflow natcap fuse tcp_bbr sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport ledtrig_heartbeat xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet
<4>[37947.340414]  ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_NPT ip6t_rt ip6t_mh ip6t_ipv6header ip6t_hbh ip6t_frag ip6t_eui64 ip6t_ah nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 msdos ip6_gre ip_gre gre ifb sit l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel ip6_tunnel tunnel6 tunnel4 ip_tunnel tun vfat fat autofs4 nls_utf8 nls_iso8859_1 nls_cp437 sha512_generic sha256_generic libsha256 sha1_generic seqiv jitterentropy_rng drbg md5 md4 hmac ghash_generic gf128mul gcm ecb des_generic libdes ctr cmac ccm arc4 uas usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_mtk xhci_hcd ohci_platform ohci_hcd softdog fsl_mph_dr_of ehci_platform ehci_fsl sd_mod scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 exfat(C) usbcore nls_base usb_common mii crc32c_generic
<4>[37947.512624] Process kworker/u8:0 (pid: 6036, threadinfo=26550c6d, task=8be035a8, tls=00000000)
<4>[37947.521189] Stack : 00000003 8e0b0c20 00000000 00000000 8e0b1044 00000001 8e0b26c8 80089444
<4>[37947.529508]         8e06d2c0 8e13e738 8e0b1e80 0000000f 8e0b2640 803c8a44 8e0b2a58 8e0b32c8
<4>[37947.537827]         00000000 8fc08000 8e0b32c8 00000000 8e0b1fa4 8e0a58f0 00000000 0000ffff
<4>[37947.546145]         8e0b3098 0000000f 00703ff3 8e0b2970 8e0b1fa4 8e0b2488 8e0b32c8 8de5cb80
<4>[37947.554464]         8fc08000 8e08c000 00000000 00000100 00000000 80690000 8fc08000 80040ef4
<4>[37947.562783]         ...
<4>[37947.565216] Call Trace:
<4>[37947.567677] [<80088620>] hrtimer_active+0x4/0x74
<4>[37947.572276] Code: 03e00008  27bd0028  8c820024 <8c43000c> 30650001  14a00011  00000000  0000000f  90850028 
<4>[37947.581986] 
<4>[37947.584529] ---[ end trace 17fce6e4d186caba ]---

Start with the reported mt76x02_wdt_work entry point and the hrtimer_active and hrtimer_try_to_cancel frames in the crash trace. Reproduce the failure on the stated MT7612-on-MT7621 master HEAD setup, then trace why the watchdog reaches an invalid timer address. Done means identifying and fixing the crash and verifying that the driver no longer produces this oops.