[BISECTED] Kernel panic (null pointer dereference) on linux-6.1 and warning on 6.2-rc2

I have a Mediatek mini-PCIe WiFi adapter in my desktop:

04:00.0 Network controller [0280]: MEDIATEK Corp. MT7612E 802.11acbgn PCI Express Wireless Network Adapter [14c3:7612]

With linux-6.0 or before, it worked acceptably. However, with linux-6.1 (I use Zen kernel on Arch Linux) it panics. So something needs to be sent to the stable team.

Here is the panic (captured over netconsole) and a few lines that precede it:

   22.143795] rfkill: input handler disabled
[   22.234236] systemd-journald[461]: Successfully sent stream file descriptor to service manager.
[   22.234395] systemd-journald[461]: Successfully sent stream file descriptor to service manager.
[   22.236424] systemd-journald[461]: Successfully sent stream file descriptor to service manager.
[   25.434800] wlp4s0: authenticate with 36:98:b5:19:b6:18
[   25.728955] wlp4s0: send auth to 36:98:b5:19:b6:18 (try 1/3)
[   25.732785] wlp4s0: authenticated
[   25.733752] wlp4s0: associate with 36:98:b5:19:b6:18 (try 1/3)
[   25.739076] wlp4s0: RX AssocResp from 36:98:b5:19:b6:18 (capab=0x1431 status=0 aid=1)
[   25.739137] wlp4s0: associated
[   25.780847] wlp4s0: Limiting TX power to 20 (20 - 0) dBm as advertised by 36:98:b5:19:b6:18
[   25.796949] IPv6: ADDRCONF(NETDEV_CHANGE): wlp4s0: link becomes ready
[   25.832219] kauditd_printk_skb: 30 callbacks suppressed
[   25.832223] audit: type=1130 audit(1673167695.026:94): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=NetworkManager-wait-online comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[   25.860211] systemd-journald[461]: Successfully sent stream file descriptor to service manager.
[   25.860501] audit: type=1130 audit(1673167695.054:95): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=clamav-freshclam comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[   25.862150] systemd-journald[461]: Successfully sent stream file descriptor to service manager.
[   26.230675] Bridge firewalling registered
[   26.231783] audit: type=1325 audit(1673167695.425:96): table=nat family=2 entries=0 op=xt_register pid=1169 comm="iptables"
[   26.231793] audit: type=1300 audit(1673167695.425:96): arch=c000003e syscall=55 success=yes exit=0 a0=4 a1=0 a2=40 a3=7ffe72d938f0 items=0 ppid=1143 pid=1169 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/bin/xtables-legacy-multi" key=(null)
[   26.231796] audit: type=1327 audit(1673167695.425:96): proctitle=2F7573722F62696E2F69707461626C6573002D2D77616974002D74006E6174002D4C002D6E
[   26.238596] audit: type=1325 audit(1673167695.428:97): table=filter family=2 entries=0 op=xt_register pid=1170 comm="iptables"
[   26.238611] audit: type=1300 audit(1673167695.428:97): arch=c000003e syscall=55 success=yes exit=0 a0=4 a1=0 a2=40 a3=7ffc5fb3ec80 items=0 ppid=1143 pid=1170 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/bin/xtables-legacy-multi" key=(null)
[   26.238616] audit: type=1327 audit(1673167695.428:97): proctitle=2F7573722F62696E2F69707461626C6573002D2D77616974002D4C002D6E
[   26.258630] audit: type=1325 audit(1673167695.452:98): table=nat family=2 entries=5 op=xt_replace pid=1191 comm="iptables"
[   26.258658] audit: type=1300 audit(1673167695.452:98): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=5647d7c45a80 items=0 ppid=1143 pid=1191 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/bin/xtables-legacy-multi" key=(null)
[   27.868370] BUG: kernel NULL pointer dereference, address: 00000000000000a8
[   27.868379] #PF: supervisor write access in kernel mode
[   27.868382] #PF: error_code(0x0002) - not-present page
[   27.868384] PGD 0 P4D 0 
[   27.868387] Oops: 0002 [#1] PREEMPT SMP PTI
[   27.868400] CPU: 1 PID: 613 Comm: napi/phy0-323 Not tainted 6.1.3-zen1-1-zen #1 e84ae47f4a6d6b4d7d2701d8d72f471c5f76a3ff
[   27.868404] Hardware name: MSI MS-7851/Z87I (MS-7851), BIOS V1.9 05/15/2015
[   27.868406] RIP: 0010:ieee80211_deliver_skb+0x4c/0x1a0 [mac80211]
[   27.868465] Code: 00 00 8b 55 70 49 8b 85 50 05 00 00 65 48 03 05 0a 63 34 3e 48 01 50 08 48 ff 00 48 83 7b 28 00 74 11 48 8b 43 30 48 63 53 44 <48> 83 84 d0 a8 00 00 00 01 8b 87 e8 11 00 00 8d 50 fd 83 fa 01 0f
[   27.868468] RSP: 0018:ffffbbb3c0917ae8 EFLAGS: 00010286
[   27.868470] RAX: 0000000000000000 RBX: ffffbbb3c0917c90 RCX: 0000000000000008
[   27.868472] RDX: 0000000000000000 RSI: ffffa0eaaece064e RDI: ffffa0ea895109c0
[   27.868474] RBP: ffffa0eaabc4f000 R08: 000000000000003b R09: 0000000000000171
[   27.868476] R10: 0000000000000171 R11: 0000000000000000 R12: 0000000000004000
[   27.868488] R13: ffffa0ea89510000 R14: 0000000000004288 R15: ffffa0eaabc4f000
[   27.868490] FS:  0000000000000000(0000) GS:ffffa0ed4f640000(0000) knlGS:0000000000000000
[   27.868493] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   27.868548] CR2: 00000000000000a8 CR3: 00000002bf210006 CR4: 00000000001706e0
[   27.868550] Call Trace:
[   27.868554]  <TASK>
[   27.868557]  __ieee80211_rx_h_amsdu+0x22f/0x5b0 [mac80211 5aa547b8289f4567c72ef207cdf47dd6bfda0f0f]
[   27.868621]  ? ieee80211_prepare_and_rx_handle+0x1384/0x1cb0 [mac80211 5aa547b8289f4567c72ef207cdf47dd6bfda0f0f]
[   27.868671]  ieee80211_prepare_and_rx_handle+0x1384/0x1cb0 [mac80211 5aa547b8289f4567c72ef207cdf47dd6bfda0f0f]
[   27.868721]  ieee80211_rx_list+0xa42/0xd70 [mac80211 5aa547b8289f4567c72ef207cdf47dd6bfda0f0f]
[   27.868763]  mt76_rx_complete+0x207/0x2e0 [mt76 778938866a7f3ea5ea095213dfa0e7b90189f510]
[   27.868773]  mt76_rx_poll_complete+0x356/0x580 [mt76 778938866a7f3ea5ea095213dfa0e7b90189f510]
[   27.868781]  ? mt76_dma_rx_fill.isra.0+0x1a0/0x220 [mt76 778938866a7f3ea5ea095213dfa0e7b90189f510]
[   27.868788]  mt76_dma_rx_poll+0x397/0x500 [mt76 778938866a7f3ea5ea095213dfa0e7b90189f510]
[   27.868797]  ? __napi_poll+0x190/0x190
[   27.868801]  __napi_poll+0x2b/0x190
[   27.868805]  napi_threaded_poll+0x157/0x170
[   27.868810]  kthread+0xde/0x110
[   27.868814]  ? kthread_complete_and_exit+0x20/0x20
[   27.868817]  ret_from_fork+0x22/0x30
[   27.868823]  </TASK>
[   27.868824] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink xt_addrtype iptable_filter br_netfilter cmac ccm tun nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_tables nfnetlink nf_nat_h323 nf_conntrack_h323 nf_nat_pptp nf_conntrack_pptp nf_nat_tftp nf_conntrack_tftp nf_nat_sip nf_conntrack_sip nf_nat_irc nf_conntrack_irc nf_nat_ftp nf_conntrack_ftp iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 netconsole bridge stp llc xt_TCPMSS xt_policy xt_tcpudp iptable_mangle snd_hda_codec_realtek intel_rapl_msr snd_hda_codec_generic ledtrig_audio intel_rapl_common snd_hda_codec_hdmi x86_pkg_temp_thermal mt76x2e snd_hda_intel spi_nor intel_powerclamp mt76x2_common uvcvideo snd_intel_dspcfg coretemp mt76x02_lib snd_intel_sdw_acpi mtd videobuf2_vmalloc videobuf2_memops mt76 kvm_intel iTCO_wdt videobuf2_v4l2 snd_hda_codec mac80211 videobuf2_common mei_pxp kvm mei_hdcp snd_hda_core intel_pmc_bxt irqbypass snd_usb_audio snd_usbmidi_lib
[   27.868860]  snd_rawmidi spi_intel_platform libarc4 videodev snd_hwdep spi_intel mei_me rapl at24 snd_seq_device r8169 iTCO_vendor_support cfg80211 i2c_i801 realtek intel_cstate snd_pcm snd_timer mc i2c_smbus mdio_devres mei intel_uncore snd rfkill mxm_wmi pcspkr soundcore libphy lpc_ich joydev mousedev mac_hid dm_multipath sg crypto_user fuse bpf_preload ip_tables x_tables btrfs blake2b_generic libcrc32c crc32c_generic xor raid6_pq usbhid dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel sha512_ssse3 aesni_intel crypto_simd sr_mod cryptd xhci_pci cdrom xhci_pci_renesas nls_iso8859_1 nls_utf8 vfat fat i915 drm_buddy intel_gtt video wmi drm_display_helper cec ttm
[   27.868903] CR2: 00000000000000a8
[   27.868905] ---[ end trace 0000000000000000 ]---
[   27.868907] RIP: 0010:ieee80211_deliver_skb+0x4c/0x1a0 [mac80211]
[   27.868936] Code: 00 00 8b 55 70 49 8b 85 50 05 00 00 65 48 03 05 0a 63 34 3e 48 01 50 08 48 ff 00 48 83 7b 28 00 74 11 48 8b 43 30 48 63 53 44 <48> 83 84 d0 a8 00 00 00 01 8b 87 e8 11 00 00 8d 50 fd 83 fa 01 0f
[   27.868938] RSP: 0018:ffffbbb3c0917ae8 EFLAGS: 00010286
[   27.868940] RAX: 0000000000000000 RBX: ffffbbb3c0917c90 RCX: 0000000000000008
[   27.868942] RDX: 0000000000000000 RSI: ffffa0eaaece064e RDI: ffffa0ea895109c0
[   27.868945] RBP: ffffa0eaabc4f000 R08: 000000000000003b R09: 0000000000000171
[   27.868948] R10: 0000000000000171 R11: 0000000000000000 R12: 0000000000004000
[   27.868950] R13: ffffa0ea89510000 R14: 0000000000004288 R15: ffffa0eaabc4f000
[   27.868952] FS:  0000000000000000(0000) GS:ffffa0ed4f640000(0000) knlGS:0000000000000000
[   27.868954] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   27.868956] CR2: 00000000000000a8 CR3: 00000002bf210006 CR4: 00000000001706e0
[   27.868958] Kernel panic - not syncing: Fatal exception in interrupt
[   27.869243] Kernel Offset: 0x32000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[   27.869257] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

I have tried the mainline kernel (6.2-rc2). It doesn't panic, but probably that's because it doesn't connect to my WiFi and frequently restarts the card. Still, on one occasion, it spewed this - possibly a different issue:

[  160.541234] wlp4s0: authenticate with 36:98:b5:19:b6:19
[  160.903648] wlp4s0: send auth to 36:98:b5:19:b6:19 (try 1/3)
[  163.217523] wlp4s0: send auth to 36:98:b5:19:b6:19 (try 2/3)
[  165.519041] wlp4s0: send auth to 36:98:b5:19:b6:19 (try 3/3)
[  165.907543] wlp4s0: aborting authentication with 36:98:b5:19:b6:19 by local choice (Reason: 3=DEAUTH_LEAVING)
[  166.834341] audit: type=1111 audit(1673166440.972:163): pid=553 uid=0 auid=4294967295 ses=4294967295 msg='op=connection-activate uuid=c53a4494-098e-46f2-baa3-f4e4668106dd name="Backbone" pid=1179 uid=1000 result=success exe="/usr/bin/NetworkManager" hostname=? addr=? terminal=? res=success'
[  166.894422] systemd-journald[386]: Successfully sent stream file descriptor to service manager.
[  166.903666] audit: type=1130 audit(1673166441.038:164): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=NetworkManager-dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[  168.015486] mt76x2e 0000:04:00.0: Firmware Version: 0.0.00
[  168.015502] mt76x2e 0000:04:00.0: Build: 1
[  168.015504] mt76x2e 0000:04:00.0: Build Time: 201507311614____
[  168.037504] mt76x2e 0000:04:00.0: Firmware running!
[  168.037979] ieee80211 phy0: Hardware restart was requested
[  168.751684] ------------[ cut here ]------------
[  168.751695] WARNING: CPU: 2 PID: 477 at net/mac80211/util.c:2624 ieee80211_reconfig+0x55e/0x16f0 [mac80211]
[  168.751772] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink xt_addrtype iptable_filter br_netfilter nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_tables nfnetlink nf_nat_h323 nf_conntrack_h323 nf_nat_pptp nf_conntrack_pptp nf_nat_tftp nf_conntrack_tftp nf_nat_sip nf_conntrack_sip nf_nat_irc nf_conntrack_irc nf_nat_ftp nf_conntrack_ftp iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tun netconsole bridge stp llc intel_rapl_msr intel_rapl_common snd_hda_codec_realtek x86_pkg_temp_thermal mt76x2e xt_TCPMSS intel_powerclamp snd_hda_codec_generic uvcvideo coretemp mt76x2_common xt_policy ledtrig_audio snd_hda_codec_hdmi videobuf2_vmalloc mt76x02_lib xt_tcpudp spi_nor kvm_intel iptable_mangle mt76 snd_hda_intel videobuf2_memops mtd kvm snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi mac80211 irqbypass snd_usb_audio at24 iTCO_wdt libarc4 intel_pmc_bxt videodev snd_hda_codec snd_usbmidi_lib rapl spi_intel_platform spi_intel
[  168.751809]  iTCO_vendor_support mei_pxp mei_hdcp intel_cstate snd_rawmidi snd_hda_core snd_hwdep snd_seq_device i2c_i801 videobuf2_common r8169 snd_pcm intel_uncore cfg80211 pcspkr mxm_wmi i2c_smbus mc lpc_ich snd_timer realtek rfkill mei_me mdio_devres snd libphy mei soundcore joydev mousedev mac_hid dm_multipath sg crypto_user fuse bpf_preload ip_tables x_tables btrfs blake2b_generic xor raid6_pq libcrc32c crc32c_generic dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod usbhid crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel sha512_ssse3 aesni_intel xhci_pci crypto_simd sr_mod cryptd cdrom xhci_pci_renesas nls_iso8859_1 nls_utf8 vfat fat i915 drm_buddy intel_gtt video wmi drm_display_helper cec ttm
[  168.751855] CPU: 2 PID: 477 Comm: kworker/2:2 Not tainted 6.2.0-rc2-1-mainline #1 ecf1332ebed7c012ad234638d8d346f1ae0e2147
[  168.751859] Hardware name: MSI MS-7851/Z87I (MS-7851), BIOS V1.9 05/15/2015
[  168.751861] Workqueue: events_freezable ieee80211_restart_work [mac80211]
[  168.751901] RIP: 0010:ieee80211_reconfig+0x55e/0x16f0 [mac80211]
[  168.751951] Code: fd 83 fa 04 74 e6 48 8b 93 98 07 00 00 83 e2 01 74 da 48 89 de 4c 89 e7 e8 2f a7 fb ff 41 89 c6 85 c0 74 c8 4d 89 e9 4d 89 e2 <0f> 0b 48 8b 5b 08 4c 89 cd 4d 89 d4 4c 39 cb 75 12 e9 6f fb ff ff
[  168.751953] RSP: 0018:ffffa32ec082bdf0 EFLAGS: 00010286
[  168.751956] RAX: 00000000fffffff0 RBX: ffff8953782a89c0 RCX: 00000000000000f8
[  168.751966] RDX: 0000000000000008 RSI: ffff8953782a9ba8 RDI: ffff8953682708e0
[  168.751970] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff895368271ab0
[  168.751974] R10: ffff8953682708e0 R11: 0000000000000000 R12: ffff8953682708e0
[  168.751979] R13: ffff895368271ab0 R14: 00000000fffffff0 R15: 0000000000000000
[  168.751981] FS:  0000000000000000(0000) GS:ffff89564f680000(0000) knlGS:0000000000000000
[  168.751986] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  168.751988] CR2: 00007f3648a80088 CR3: 00000001f3610006 CR4: 00000000001706e0
[  168.751990] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  168.751994] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  168.751998] Call Trace:
[  168.752004]  <TASK>
[  168.752009]  ieee80211_restart_work+0xf5/0x150 [mac80211 410b83d45043a4cb94322898869721d223f7a201]
[  168.752048]  process_one_work+0x1c8/0x380
[  168.752057]  worker_thread+0x51/0x390
[  168.752062]  ? __pfx_worker_thread+0x10/0x10
[  168.752068]  kthread+0xde/0x110
[  168.752071]  ? __pfx_kthread+0x10/0x10
[  168.752076]  ret_from_fork+0x2c/0x50
[  168.752084]  </TASK>
[  168.752086] ---[ end trace 0000000000000000 ]---
[  168.754352] systemd-journald[386]: Compressed data object 990 -> 495 using ZSTD
[  168.754393] systemd-journald[386]: Compressed data object 771 -> 473 using ZSTD
[  168.774219] ------------[ cut here ]------------
[  168.774233] wlp4s0: Failed check-sdata-in-driver check, flags: 0x0
[  168.774271] WARNING: CPU: 2 PID: 477 at net/mac80211/driver-ops.c:99 drv_remove_interface+0x114/0x120 [mac80211]
[  168.774336] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink xt_addrtype iptable_filter br_netfilter nft_reject_ipv4 nf_reject_ipv4 nft_reject nft_ct nft_masq nft_chain_nat nf_tables nfnetlink nf_nat_h323 nf_conntrack_h323 nf_nat_pptp nf_conntrack_pptp nf_nat_tftp nf_conntrack_tftp nf_nat_sip nf_conntrack_sip nf_nat_irc nf_conntrack_irc nf_nat_ftp nf_conntrack_ftp iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tun netconsole bridge stp llc intel_rapl_msr intel_rapl_common snd_hda_codec_realtek x86_pkg_temp_thermal mt76x2e xt_TCPMSS intel_powerclamp snd_hda_codec_generic uvcvideo coretemp mt76x2_common xt_policy ledtrig_audio snd_hda_codec_hdmi videobuf2_vmalloc mt76x02_lib xt_tcpudp spi_nor kvm_intel iptable_mangle mt76 snd_hda_intel videobuf2_memops mtd kvm snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi mac80211 irqbypass snd_usb_audio at24 iTCO_wdt libarc4 intel_pmc_bxt videodev snd_hda_codec snd_usbmidi_lib rapl spi_intel_platform spi_intel
[  168.774392]  iTCO_vendor_support mei_pxp mei_hdcp intel_cstate snd_rawmidi snd_hda_core snd_hwdep snd_seq_device i2c_i801 videobuf2_common r8169 snd_pcm intel_uncore cfg80211 pcspkr mxm_wmi i2c_smbus mc lpc_ich snd_timer realtek rfkill mei_me mdio_devres snd libphy mei soundcore joydev mousedev mac_hid dm_multipath sg crypto_user fuse bpf_preload ip_tables x_tables btrfs blake2b_generic xor raid6_pq libcrc32c crc32c_generic dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod usbhid crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel sha512_ssse3 aesni_intel xhci_pci crypto_simd sr_mod cryptd cdrom xhci_pci_renesas nls_iso8859_1 nls_utf8 vfat fat i915 drm_buddy intel_gtt video wmi drm_display_helper cec ttm
[  168.774446] CPU: 2 PID: 477 Comm: kworker/2:2 Tainted: G        W          6.2.0-rc2-1-mainline #1 ecf1332ebed7c012ad234638d8d346f1ae0e2147
[  168.774450] Hardware name: MSI MS-7851/Z87I (MS-7851), BIOS V1.9 05/15/2015
[  168.774453] Workqueue: events_freezable ieee80211_restart_work [mac80211]
[  168.774501] RIP: 0010:drv_remove_interface+0x114/0x120 [mac80211]
[  168.774550] Code: ff ff 48 8b 83 80 07 00 00 48 8d b3 a0 07 00 00 48 c7 c7 b0 3b 3e c1 c6 05 6d a9 10 00 01 48 85 c0 48 0f 45 f0 e8 f3 f4 19 c5 <0f> 0b 5b 5d c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90
[  168.774552] RSP: 0018:ffffa32ec082bcc8 EFLAGS: 00010282
[  168.774555] RAX: 0000000000000000 RBX: ffff8953782a89c0 RCX: 0000000000000027
[  168.774561] RDX: ffff89564f6a1648 RSI: 0000000000000001 RDI: ffff89564f6a1640
[  168.774565] RBP: ffff8953682708e0 R08: 0000000000000000 R09: ffffa32ec082bb60
[  168.774567] R10: 0000000000000003 R11: ffff89565fcfffe8 R12: ffff8953682708e0
[  168.774569] R13: ffff8953782a9ba8 R14: ffff8953682711e0 R15: 0000000000000000
[  168.774572] FS:  0000000000000000(0000) GS:ffff89564f680000(0000) knlGS:0000000000000000
[  168.774577] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  168.774579] CR2: 00007f3648a80088 CR3: 00000001f3610001 CR4: 00000000001706e0
[  168.774584] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  168.774586] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  168.774591] Call Trace:
[  168.774596]  <TASK>
[  168.774601]  ieee80211_do_stop+0x662/0x8a0 [mac80211 410b83d45043a4cb94322898869721d223f7a201]
[  168.774644]  ieee80211_stop+0x4d/0x180 [mac80211 410b83d45043a4cb94322898869721d223f7a201]
[  168.774685]  __dev_close_many+0x9e/0x110
[  168.774689]  dev_close_many+0x8f/0x150
[  168.774695]  ? ieee80211_handle_reconfig_failure+0x69/0x90 [mac80211 410b83d45043a4cb94322898869721d223f7a201]
[  168.774741]  dev_close+0x83/0xb0
[  168.774746]  cfg80211_shutdown_all_interfaces+0x4d/0xf0 [cfg80211 1605a2dada9c32fd4c9df2357ae678d7b25d2404]
[  168.774796]  ieee80211_restart_work+0x120/0x150 [mac80211 410b83d45043a4cb94322898869721d223f7a201]
[  168.774831]  process_one_work+0x1c8/0x380
[  168.774836]  worker_thread+0x51/0x390
[  168.774842]  ? __pfx_worker_thread+0x10/0x10
[  168.774845]  kthread+0xde/0x110
[  168.774851]  ? __pfx_kthread+0x10/0x10
[  168.774853]  ret_from_fork+0x2c/0x50
[  168.774861]  </TASK>
[  168.774863] ---[ end trace 0000000000000000 ]---
[  176.937776] audit: type=1131 audit(1673166451.075:165): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=NetworkManager-dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

Start by reproducing the reported failure with the MT7612E adapter on Linux 6.1 and compare it with 6.0 and 6.2-rc2. Trace the reported mt76_rx_complete, __ieee80211_rx_h_amsdu, ieee80211_prepare_and_rx_handle, and ieee80211_deliver_skb paths; done means the kernel no longer panics or emits the related warning under the affected connection and restart scenarios.