Bad page state in process napi

D-Link DIR-860L B1, running OpenWrt SNAPSHOT, r20212-beeb49740b, got the following crash warnings.

[374700.655444] BUG: Bad page state in process napi/mtk_eth-6  pfn:03403
[374700.683710] page:6698cfa7 refcount:-1 mapcount:0 mapping:00000000 index:0x0 pfn:0x3403
[374700.699636] flags: 0x0()
[374700.704855] raw: 00000000 00000000 80acdfd4 00000000 00000000 00000000 ffffffff ffffffff
[374700.721116] raw: 00000000
[374700.726487] page dumped because: nonzero _refcount
[374700.736179] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt76x2e mt76x2_common mt76x02_lib mt76 mac80211 cfg80211 slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_ipv6 nf_log_ipv4 nf_log_common nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c crc_ccitt compat ledtrig_usbport sha256_generic libsha256 seqiv jitterentropy_rng drbg hmac cmac leds_gpio xhci_plat_hcd xhci_pci xhci_mtk xhci_hcd gpio_button_hotplug usbcore nls_base usb_common crc32c_generic
[374700.875636] CPU: 1 PID: 379 Comm: napi/mtk_eth-6 Not tainted 5.10.134 #0
[374700.889134] Stack : 80a40000 00000003 00000000 8008348c 808d0000 807bcef0 00000000 00000000
[374700.905970]         80ecdbb4 80a20000 8078afd4 80e31b48 8085ae87 00000001 80ecdb58 46b76fd2
[374700.922806]         00000000 00000000 8078afd4 80ecd9f8 ffffefff 00000000 ffffffea 00000000
[374700.939642]         80ecda04 0000016e 80860888 ffffffff 00000000 00000000 00000000 80790000
[374700.956478]         80850000 80a50000 808e18e0 00000003 00000000 804056f0 00000004 80a20004
[374700.973315]         ...
[374700.978354] Call Trace:
[374700.983413] [<800080e0>] show_stack+0x30/0x100
[374700.992442] [<80380ef4>] dump_stack+0x9c/0xcc
[374701.001297] [<8017db44>] bad_page+0x100/0x12c
[374701.010135] [<801815e8>] get_page_from_freelist+0x474/0xd60
[374701.021392] [<801823e4>] __alloc_pages_nodemask+0x13c/0xe88
[374701.032649] [<80183218>] page_frag_alloc+0xb0/0x1a8
[374701.042529] [<804a0fdc>] mtk_napi_rx+0x2ec/0x820
[374701.051897] [<8050c13c>] __napi_poll+0x3c/0x15c
[374701.061079] [<8050c3bc>] napi_threaded_poll+0x160/0x1a8
[374701.071650] [<80050c00>] kthread+0x13c/0x144
[374701.080314] [<80002ff8>] ret_from_kernel_thread+0x14/0x1c
[374701.091226]
[374701.094354] Disabling lock debugging due to kernel taint

Any idea what's wrong?