This is one of the weirdest things I've ever encountered.
First of all, here's my setup:
The main router is a WRT3200ACM running OpenWrt 23.05.5, connected directly to the Internet. I've created two LANs, one for me (VLAN 1) and one for guests (VLAN 3). There's no VLAN 2 for legacy reasons. There are also two wireless networks, one for each VLAN.
Three of the main router's LAN ports are used as regular LAN ports for the main LAN. The fourth is a tagged port, carrying both VLANs. This is due to a secondary access point in a different area, which is connected to the main router via a single Ethernet cable.
The secondary acces point is an old TP-Link TL-WR1043NDv1 still running Backfire. I can't really update it due to it only having 32MB of RAM, but I've secured it so neiher SSH nor LuCI are accessible from the guest network. The previously WAN port serves as the upstream (tagged) port. The other LAN ports are split, with two going to the main VLAN and two to the guest VLAN. As with the main router, there are two WLANs, one serving each VLAN.
Now here's the weird part:
When a computer is connected to the secondary AP using a wired connection everything works perfectly, as expected.
However, when a client is conneced through WLAN (only on the secondary AP), ICMP, UDP and TCP packets without payload (SYN/ACK/FIN/RST) pass through successfully, but any TCP packet containing actual data is lost.
The main suspect was the secondary AP, obviously, but I've verified with tcpdump that the packets are successfully sent on the wire. Then I went to capture on the main router, and here's when it gets seriously weird - If I capture directly on the lan port interface, all packets show up, as expected, but if I capture on the bridge interface that the lan port is associated with, the TCP data packets don't show up. I've inspected the capture done on the lan port and the soon to be lost packets don't seem broken in any way.
I'm seriously clueless about this. I'd appreciate any insights on how to debug.
EDIT: I've tried replacing the secondary router with a more recent one (TP-Link Archer C7 v2 running OpenWrt 19.07), same issue. Also, it seems that there's no issue with data packets coming from the internet to the LAN, only outgoing packets get lost.