The bug FS#3561 is also related to MTK hardware offloading, but it's a different issue which has already been resolved, we never saw that on Linux 5.10. Doesn't mean that it's unrelated, but it's definitely a different place in the code where things go wrong.
<1>[1375173.739141] [dead000000000110] address between user and kernel address ranges
...
<7>[1375173.979700] Call trace:
<7>[1375173.982316] nf_flow_offload_ip_hook+0x778/0x1340 [nf_flow_table]
<7>[1375173.988575] nf_flow_table_offload_setup+0x334/0x660 [nf_flow_table]
...
vs.
[ 1148.631719] Unable to handle kernel paging request at virtual address ffffff883e35ffa0
...
[ 1149.188834] Call trace:
[ 1149.191272] mtk_flow_offload_add+0xd0/0x180
[ 1149.195531] mtk_flow_offload+0x4c/0x60
...
The old bug on 5.4 was also very easy to trigger, it happened quite immediately once there was traffic being routed.