kernel panic: ath9k + ipv6 in AP mode on x86-64

kernel panic captured on 4.2.6, but panics are reproducible going back
to at least 4.0.9.  The particular oops / stack trace isn't consistent
but it's often a page fault.
Reproduction method:
ath9k + hostapd + ipv4: no crash (been running for year+)
ath9k + hostapd + ipv6: near instant crash with wireless ipv6 traffic.
ipv6 routing wired to wired on the same host has no issues.

Attached is serial console output of the oops, /proc/version, lspci
-nnn and a boot dmesg.

Let me know if i can help at all.  It reproduces very quickly.