mt7915e crash log: ieee80211_calc_expected_tx_airtime+0xcc/0x218 [mac80211]

<3>[25146.128036] mt7915e 0000:02:00.0: Retry message 00005aed (seq 14)
<3>[25148.208118] mt7915e 0000:02:00.0: Message 00005aed (seq 14) timeout
<3>[25168.847742] mt7915e 0000:02:00.0: Retry message 00000010 (seq 1)
<3>[25189.327626] mt7915e 0000:02:00.0: Message 00000010 (seq 1) timeout
<3>[25189.335035] mt7915e 0000:02:00.0: Failed to get patch semaphore
<3>[25209.807322] mt7915e 0000:02:00.0: Retry message 00000010 (seq 2)
<3>[25230.287138] mt7915e 0000:02:00.0: Message 00000010 (seq 2) timeout
<3>[25230.293374] mt7915e 0000:02:00.0: Failed to get patch semaphore
<6>[25230.459096] mt7915e 0000:02:00.0: HW/SW Version: 0x8a108a10, Build Time: 20240429200716a
<6>[25230.459096] 
<6>[25230.491859] mt7915e 0000:02:00.0: WM Firmware Version: ____000000, Build Time: 20240429200752
<6>[25230.532617] mt7915e 0000:02:00.0: WA Firmware Version: DEV_000000, Build Time: 20240429200812
<6>[25236.146474] ieee80211 phy0: Hardware restart was requested
<6>[25236.156213] ieee80211 phy1: Hardware restart was requested
<1>[25236.290235] CPU 3 Unable to handle kernel paging request at virtual address 00000004, epc == 8336d434, ra == 8333f570
<4>[25236.300998] Oops[#1]:
<4>[25236.303326] CPU: 3 PID: 1119 Comm: mt76-tx phy0 Tainted: G           O       6.6.63 #0
<4>[25236.311279] $ 0   : 00000000 00000001 00000000 00000000
<4>[25236.316582] $ 4   : 00000000 82d271f8 00000000 0000003c
<4>[25236.321880] $ 8   : 88ed19c0 830784c0 00000000 000000d0
<4>[25236.327187] $12   : 00001433 00000010 00000004 00000000
<4>[25236.332519] $16   : 00000062 88ed19c0 82d27ccc 88ed19d8
<4>[25236.337838] $20   : 82c84930 bcf5f33f 82d27c28 82d27c28
<4>[25236.343158] $24   : 00000000 0030f3e4                  
<4>[25236.348469] $28   : 844a2000 844a3d60 830784c0 8333f570
<4>[25236.353792] Hi    : 00009376
<4>[25236.356723] Lo    : 5c81f414
<4>[25236.359635] epc   : 8336d434 ieee80211_calc_expected_tx_airtime+0xcc/0x218 [mac80211]
<4>[25236.367735] ra    : 8333f570 ieee80211_tx_dequeue+0xab4/0x1a7c [mac80211]
<4>[25236.374683] Status: 1100fc03	KERNEL EXL IE 
<4>[25236.378898] Cause : 40800008 (ExcCode 02)
<4>[25236.382917] BadVA : 00000004
<4>[25236.385809] PrId  : 0001992f (MIPS 1004Kc)
<4>[25236.389912] Modules linked in: pppoe ppp_async wireguard pptp pppox ppp_mppe ppp_generic nft_fib_inet mt7915e(O) mt76_connac_lib(O) mt76(O) mac80211(O) libchacha20poly1305 ipt_REJECT cfg80211(O) xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_MASQUERADE xt_LOG xt_HL xt_DSCP xt_CLASSIFY ts_fsm ts_bm tcp_scalable tcp_bbr slhc sch_cake poly1305_mips nft_tproxy nft_socket nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject_bridge nft_reject nft_redir nft_quota nft_queue nft_numgen nft_nat nft_meta_bridge nft_masq nft_log nft_limit nft_hash nft_fwd_netdev nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_dup_netdev nft_ct nft_compat nft_chain_nat nfnetlink_queue nf_tproxy_ipv6 nf_tproxy_ipv4 nf_tables nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda
<4>[25236.390521]  nf_log_syslog nf_dup_netdev nf_conntrack_tftp nf_conntrack_snmp nf_conntrack_sip nf_conntrack_sane nf_conntrack_pptp nf_conntrack_netbios_ns nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack_broadcast nf_conntrack_bridge ts_kmp nf_conntrack_amanda nf_conncount macvlan libcurve25519_generic libcrc32c ipvlan iptable_nat iptable_mangle iptable_filter ipt_ECN ip_tables hwmon crc_ccitt compat(O) chacha_mips br_netfilter asn1_decoder natflow(O) natcap(O) nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred act_gact cryptodev(O) xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ipmac ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_mangle ip6table_filter
<4>[25236.480498]  ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 ip6_gre ip_gre gre ip6_udp_tunnel udp_tunnel sit ip6_tunnel tunnel6 tunnel4 ip_tunnel tun nls_utf8 nls_iso8859_1 nls_base crypto_user algif_skcipher algif_rng algif_hash algif_aead af_alg sha512_generic sha256_generic libsha256 sha1_generic seqiv sha3_generic drbg md5 crypto_hw_eip93 hmac geniv rng ecb des_generic libdes cmac authencesn authenc arc4 leds_gpio softdog gpio_button_hotplug(O) crc32c_generic
<4>[25236.611506] Process mt76-tx phy0 (pid: 1119, threadinfo=f458199d, task=2a6af853, tls=00000000)
<4>[25236.620152] Stack : 809ad4c0 000000f4 00000101 80318c00 00000000 7031c923 00007e44 ffffffff
<4>[25236.628591]         00000003 00000001 00000001 81028420 00000002 00000000 844a3e00 88ed19c0
<4>[25236.636990]         82d27ccc 88ed19d8 82c84930 bcf5f33f 82d27c28 844a3e00 88ed19c0 8333f570
<4>[25236.645402]         00000003 80028d34 00000001 81028420 00000000 800980a8 80a07cc0 82d27c30
<4>[25236.653830]         38e38e39 83078570 83078640 83078938 82d271f8 82d27cb8 844a3df4 00000000
<4>[25236.662247]         ...
<4>[25236.664733] Call Trace:
<4>[25236.667183] [<8336d434>] ieee80211_calc_expected_tx_airtime+0xcc/0x218 [mac80211]
<4>[25236.675005] [<8333f570>] ieee80211_tx_dequeue+0xab4/0x1a7c [mac80211]
<4>[25236.681711] [<832d96b8>] mt76_tx+0x76c/0xa60 [mt76]
<4>[25236.686733] [<80032440>] do_softirq+0x8c/0x94
<4>[25236.691317] 
<4>[25236.692836] Code: 00031040  00431021  00021080 <8c830004> 00621021  8c430000  94440004  30620004  1440001e 
<4>[25236.702613] 
<4>[25236.704196] ---[ end trace 0000000000000000 ]---

The report provides an mt7915e firmware-timeout and hardware-restart sequence, followed by a MIPS paging fault in ieee80211_calc_expected_tx_airtime and ieee80211_tx_dequeue. Start by reproducing the crash on the reported kernel 6.6.63 and tracing that restart path; done means identifying the fault and confirming that a fix prevents the crash.