mt7921u: kernel crashes while generating traffic

Device is in AP mode and operational. I can connect to it just fine, and it works a while, but the kernel crashes every now and then.
I don't have serial setup on the router it's connected to, so unfortunately the only log entry I have at this time is:

kern.emerg kernel: [37856.956725] skbuff: skb_under_panic: text:834905b0 len:128 put:4 head:85b52ba0 data:85b52b9e tail:0x85b52c1e end:0x85b53400 dev:XXX

0e8d:7961 Comfast CF-953AX (MT7921AU)
Version: https://github.com/openwrt/mt76/commit/4a27f23fc4f22510db81513680666be7e72ccb61
OpenWrt with a rather simple config:

config wifi-device 'radio2'                                                     
    option type 'mac80211'                                                      
    option path 'platform/1e1c0000.xhci/usb1/1-2/1-2:1.3'                       
    option band '5g'                                                            
    option country 'DE'                                                         
    option cell_density '0'                                                     
    option channel '149'                                                        
    option htmode 'HE80'                                                        
                                                                                
config wifi-iface 'wifinet1'                                                    
    option device 'radio2'                                                      
    option mode 'ap'                                                            
    option ssid 'XXX'                                                       
    option encryption 'sae'                                                     
    option ifname 'XXX'                                                     
    option key 'XXX'                                                
    option network 'lan'  

Start with the reported OpenWrt AP configuration, the mt76 commit, and the skb_under_panic log. Reproduce traffic with serial or equivalent kernel logging enabled, then isolate the crash and verify that the kernel no longer panics under the same setup.