WRT900AC and ESP8266 - again

Yes, I know. This has been discussed many times before. But I still can't figure out the asnwer to this simple question:

Is there any way I can configure OpenWrt so that the WRT1900AC+ESP8266 combination works?

What I have right now fails:

config wifi-device 'radio0'
        option type 'mac80211'
        option channel '1'
        option hwmode '11g'
        option path 'soc/soc:pcie@82000000/pci0000:00/0000:00:02.0/0000:02:00.0'
        option htmode 'NOHT'
        option country 'NO'
        option noscan '1'

config wifi-iface
        option device 'radio0'
        option network 'iot'
        option mode 'ap'
        option ssid 'iot'
        option encryption 'psk2'
        option key '<redacted>'
        option macaddr 'b4:75:0e:60:b7:e6'
        option isolate '0'
        option wmm '0'

The problem is the same as before I disabled 11n and WMM: The ESP8266 device associates with the AP and sends a DHCP request, but it never receives the offer from the DHCP server.

I can see the requests and offers on the bridge interface:

root@wrt1900ac-1:~# tcpdump -ni br-iot -f 'udp port 67'
tcpdump: WARNING: foreign (-f) flag used but: br-iot: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on br-iot, link-type EN10MB (Ethernet), snapshot length 262144 bytes
20:37:13.831001 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from d8:bf:c0:d6:ff:e1, length 308
20:37:13.831731 IP 192.168.15.1.67 > 192.168.15.131.68: BOOTP/DHCP, Reply, length 300
20:37:17.853893 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from d8:bf:c0:d6:ff:e1, length 308
20:37:17.854788 IP 192.168.15.1.67 > 192.168.15.131.68: BOOTP/DHCP, Reply, length 300
^C

The station assoc looks like this:

root@wrt1900ac-1:~# iw wlan0-1 station dump
Station d8:bf:c0:d6:ff:e1 (on wlan0-1)
        inactive time:  860 ms
        rx bytes:       1475
        rx packets:     7
        tx bytes:       403
        tx packets:     4
        tx retries:     0
        tx failed:      0
        rx drop misc:   1
        signal:         -54 dBm
        signal avg:     -54 dBm
        tx bitrate:     1.0 MBit/s
        tx duration:    0 us
        rx bitrate:     22.0 MBit/s
        rx duration:    0 us
        authorized:     yes
        authenticated:  yes
        associated:     yes
        preamble:       short
        WMM/WME:        no
        MFP:            no
        TDLS peer:      no
        DTIM period:    2
        beacon interval:100
        short preamble: yes
        connected time: 7 seconds
        associated at [boottime]:       352847.029s
        associated at:  1663958100633 ms
        current time:   1663958107037 ms

The device works fine with OpenWrt on my other APs (Unifi AC Pro), using the same DHCP server and network, so the problem is definitely with the WRT1900AC. As expected from e.g https://github.com/kaloz/mwlwifi/issues/170

But is there really no way to dumb this wifi interface down to make it work? I don't use 2.4GHz for much else, so I don't really care about modern features. Turning it off is of course an option, leaving the band exclusibley for the Unfi's. Might end with that. But I'd still like to know the answer.

The ESP8266 is running Tasmota if that matters. No sure I can do much debugging there anyway.