MT76: Kernel crash with 802.11s Mesh on Linksys E5600

I am relatively new to OpenWrt, and trying to run a mesh setup between two routers(both on OpenWrt).
After a while(sometimes minutes, sometimes overnight), my downstream router doesn't offer internet/dhcp anymore - though the Mesh link seems to be connected(shows connected at VHT in both routers).
I have noticed this is more probable when a device joins/leaves an AP on my downstream router.

Below is the text from router-2(downstream) Kernel Log:

[   22.048895] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0-1: link becomes ready
[   23.335200] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   23.431657] br-lan: port 8(wlan1) entered blocking state
[   23.437031] br-lan: port 8(wlan1) entered disabled state
[   23.442860] device wlan1 entered promiscuous mode
[   23.447882] br-lan: port 8(wlan1) entered blocking state
[   23.453245] br-lan: port 8(wlan1) entered forwarding state
[   24.554755] ------------[ cut here ]------------
[   24.559439] WARNING: CPU: 3 PID: 3128 at net/core/flow_dissector.c:958 __skb_flow_dissect+0x2d4/0x16c4
[   24.568729] Modules linked in: pppoe ppp_async iptable_nat xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE xt_FLOWOFFLOAD pppox ppp_generic nf_nat nf_flow_table_hw nf_flow_table nf_conntrack_rtcache nf_conntrack mt7615e mt7615_common mt7603e mt76_connac_lib mt76 mac80211 ipt_REJECT cfg80211 xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG slhc nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_filter ip_tables crc_ccitt compat nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 leds_gpio gpio_button_hotplug
[   24.624279] CPU: 3 PID: 3128 Comm: kworker/u9:2 Not tainted 5.4.105 #0
[   24.630803] Workqueue: napi_workq napi_workfn
[   24.635140] Stack : 80632d18 86d91a3c 806b0000 806f0000 86688900 80644afc 8040c9e8 00000009
[   24.643468]         87f050f8 872ee018 00000000 8007d904 00000003 00000001 86d919f8 453c6bb3
[   24.651795]         00000000 00000000 00000000 00000000 716b726f 0000014f 6f775f69 6e666b72
[   24.660116]         00000000 00000001 00000000 0009a013 00000000 80710000 00000000 8040c9e8
[   24.668438]         00000009 87f050f8 872ee018 00000000 00000000 8034d838 0000000c 8085000c
[   24.676764]         ...
[   24.679202] Call Trace:
[   24.681659] [<8000b64c>] show_stack+0x30/0x100
[   24.686106] [<8058876c>] dump_stack+0xa4/0xdc
[   24.690459] [<8002bfe8>] __warn+0xc0/0x10c
[   24.694544] [<8002c090>] warn_slowpath_fmt+0x5c/0xac
[   24.699498] [<8040c9e8>] __skb_flow_dissect+0x2d4/0x16c4
[   24.704789] [<8040e088>] __skb_get_hash+0x7c/0x258
[   24.709696] [<86832dd4>] ieee80211_unreserve_tid+0x66c/0xb40 [mac80211]
[   24.716462] ---[ end trace 01615c3ed90ba916 ]---

Text from router-2(downstream) System Log at approximately the same time:

Wed Mar 17 01:19:42 2021 daemon.info hostapd: wlan1-1: STA aa:ce:91:88:58:08 IEEE 802.11: authenticated
Wed Mar 17 01:19:42 2021 daemon.info hostapd: wlan1-1: STA aa:ce:91:88:58:08 IEEE 802.11: associated (aid 1)
Wed Mar 17 01:19:42 2021 daemon.notice hostapd: wlan1-1: AP-STA-CONNECTED aa:ce:91:88:58:08
Wed Mar 17 01:19:42 2021 daemon.info hostapd: wlan1-1: STA aa:ce:91:88:58:08 RADIUS: starting accounting session CB042D40F6F1A16C
Wed Mar 17 01:19:42 2021 daemon.info hostapd: wlan1-1: STA aa:ce:91:88:58:08 WPA: pairwise key handshake completed (RSN)
Wed Mar 17 01:20:11 2021 daemon.notice hostapd: wlan1-1: AP-STA-DISCONNECTED aa:ce:91:88:58:08
Wed Mar 17 01:42:34 2021 daemon.info hostapd: wlan0-1: STA 6a:a3:f6:a3:f6:3b IEEE 802.11: authenticated
Wed Mar 17 01:42:34 2021 daemon.info hostapd: wlan0-1: STA 6a:a3:f6:a3:f6:3b IEEE 802.11: associated (aid 1)
Wed Mar 17 01:42:34 2021 daemon.notice hostapd: wlan0-1: AP-STA-CONNECTED 6a:a3:f6:a3:f6:3b
Wed Mar 17 01:42:34 2021 daemon.info hostapd: wlan0-1: STA 6a:a3:f6:a3:f6:3b RADIUS: starting accounting session 2F8CE9786D59A97D
Wed Mar 17 01:42:34 2021 daemon.info hostapd: wlan0-1: STA 6a:a3:f6:a3:f6:3b WPA: pairwise key handshake completed (RSN)

Configuration on both my routers:
Router-1(Netgear R6220) config[UPSTREAM]:

  1. 2 AP(SSID) on 2.4Ghz on channel 13 @ 25dBm TX power.
  2. 2 AP(SSID)(WPA2 PSK - Forced CCMP) + 1 MeshPoint(No Encryption) on 5Ghz.
  3. 5Ghz radio settings: 80MHz width on channel 153 @ 25dBm TX power.
  4. Uses wpad-mesh-wolfssl.
  5. LAN iface is set to 192.168.1.1/24 with DHCP enabled.
  6. MeshPoint is bridged to LAN-br iface.
  7. Software flow offloading & Hardware flow offloading are both disabled.
  8. Fimware version: Release OpenWrt 19.07.7 r11306-c4a6851c72 / LuCI openwrt-19.07 branch git-21.044.30835-34e0d65

Router-2(Linksys E5600) config[DOWNSTREAM]:

  1. 1 AP(SSID)(No encryption) on 2.4Ghz on channel 3 @ 20dBm TX power.
  2. 1 AP(SSID)(No encryption) + 1 MeshPoint(No Encryption) on 5Ghz.
  3. 5Ghz radio settings: 80MHz width on channel 153 @ 21dBm TX power.
  4. Uses wpad-mesh-wolfssl.
  5. LAN iface is set to 192.168.2.1/24 with DHCP disabled for both ipv4 & ipv6.
  6. MeshPoint is bridged to LAN-br iface.
  7. Software flow offloading & Hardware flow offloading are both disabled.
  8. Built from SNAPSHOT with 'kmod-mt7663-firmware-ap' & 'kmod-mt7663-firmware-sta' included. Details in this thread: Adding OpenWrt support for Linksys E5600
  9. Fimware version: OpenWrt SNAPSHOT r16197-83547284b5 / LuCI Master git-21.073.44902-d8a277b

I just updated to OpenWrt 19.07.7 r11306-c4a6851c72 and have had unexpected router crash and reboot cycles. Doesn't even capture a log to the reason why (system.log to usb device).

You might try an older firmware revision?