[bug] Triple whammy of mt7996e bugs on 7.2+

Hey folks,

Not really sure where to report this, but I've encountered some "interesting" issues on my bpi-r4 running kernel 7.2 and up.

The first issue is that after a while the firmware on the mt7996e sometimes seemingly just locks up. 
As it usually is with those things, there's not much debug info available, so all I get is

[58764.004954] mt7996e 0000:01:00.0: Message 00130022 (seq 12) timeout

This has happened before, but very rarely, and now it seems to happen consistently at least once a day or so, on
the exact same setup that is stable for weeks on end with 7.1. I have not attempted a bisect yet because
1) I kinda need my network to actually work reliably and 2) it happens so inconsistently that it's hard to
pin down a good commit.

The other issue is that the kernel then fully explodes trying to recover from this, in two different ways 
depending on whether WED is enabled or disabled: with WED on, it tries to double free a page somewhere on the 
teardown path, and with WED off it just wedges seemingly all of nl80211 and any process that happened to be talking to it.

I'm attaching the logs for both cases, hopefully this helps figure out what's going on, and happy to do more testing if
needed.

For posterity, my current kernel tree is basically vanilla + just enough changes to get bpi-r4 10G ports working on NixOS:
- 7.1 branch: https://github.com/K900/linux/tree/bpi-r4-71
- 7.2 branch: https://github.com/K900/linux/tree/bpi-r4-72

(there are exactly zero *80211/mt76/mt7996e changes).

Oh, I've also tried pulling the latest firmware from vendor OpenWRT feed and that did not help matters at all.

Any help in figuring this out would be greatly appreciated!

- Ilya