Untested, but should work:
fw_setenv CheckBypass 0
mtd -r -e Kernel write <OEM-backup-image> Kernel
Clearing CheckBypass ensures that the bootloader validates the image. Caveat: If something is wrong, then it will copy the image in Kernel2 into Kernel and retry. This could revert to a very old OEM image, or whatever you have in Kernel2.
You can also use this for a simplfied revert to OEM if you believe you have a good OEM image in Kernel2. Then you could clear CheckBypass and erase Kernel, letting the bootloader clean up on next boot
I see that you got it (sort of) working. Just for completeness: This part is exactly like making any other QMI device working. I have no better intstructions than the generic 3G/LTE instructions in the Wiki.
This can mostbly be considered informational debug, despite the scaring stack trace. The TX queue timeout for usbnet devices is set to 5 seconds by default. Which usually is long enough. You don't want to wait any longer to transmit a packet. But occasional failures to meet that deadline is still expected for any mobile device. This could be casued by some error, like a firmware lockup, but more likely it's just a temporary radio issue.