simonwunderlich:

I've tested lede-17.01 branch (ee1cd31) with a vanilla config for OM2P-HSv4 and tx99 turned on for ath9k (please see .config attached).

After booting up, I've used the following commands to test TX99:

iw phy phy0 interface add mon0 type monitor flags active
ip link set dev mon0 up
iw dev mon0 set channel 6 HT20
iw dev mon0 set bitrates ht-mcs-2.4 4
echo 10 > /sys/kernel/debug/ieee80211/phy0/ath9k/tx99_power
echo 1 > /sys/kernel/debug/ieee80211/phy0/ath9k/tx99

The last command hangs and causes the crash/reboot.

This is the crashlog found after reboot:

root@LEDE:~# cat /sys/kernel/debug/crashlog
Time: 1488374337.404187
Modules: ath9k@83040000+1725e ath9k_common@83110000+496e pppoe@83264000+1f30 ppp_async@8308e000+18d0 iptable_nat@831ed000+310 ath9k_hw@83200000+52a0c ath@831e8000+4573 pppox@830a2000+56a ppp_generic@830a8000+4fa2 nf_nat_ipv4@830fb000+eb1 nf_conntrack_ipv6@831e6000+1410 nf_conntrack_ipv4@83bba000+12b0 mac80211@83180000+65c42 ipt_REJECT@830a4000+3b0 ipt_MASQUERADE@83bbf000+2b0 cfg80211@830c0000+39118 xt_time@83bbc000+670 xt_tcpudp@83bb9000+6f0 xt_state@83ba9000+2d0 xt_nat@83bb0000+490 xt_multiport@83bb1000+4d0 xt_mark@83bae000+2b0 xt_mac@83ba5000+290 xt_limit@8300f000+410 xt_conntrack@83baa000+8d0 xt_comment@83ba3000+210 xt_TCPMSS@83ba1000+ab0 xt_REDIRECT@83ba2000+2b0 xt_LOG@83037000+310slhc@83026000+115b nf_reject_ipv4@83004000+863 nf_nat_redirect@83025000+3db nf_nat_masquerade_ipv4@83b8b000+59c nf_nat@83b8c000+237b nf_log_ipv4@83031000+c90 nf_defrag_ipv6@83b88000+2457 nf_defrag_ipv4@8303f000+396 nf_conntrack_rtcache@8303c000+9b0 nf_conntrack@83b90000+bb69 iptable_mangle@83001000+3b0 iptable_filter@83003000+2d0 ip_tables@83020000+24ed crc_ccitt@83b7a000+40b compat@83008000+2366 ip6t_REJECT@83b79000+3d0 nf_reject_ipv6@83002000+908 nf_log_ipv6@83b78000+d50 nf_log_common@83bc7000+92f ip6table_mangle@83bff000+470 ip6table_filter@83b76000+290 ip6_tables@83b7c000+2441 x_tables@83bc4000+2d67 gpio_button_hotplug@83b4a000+1870
<5>[ 0.000000] Linux version 4.4.50 (dotslash@prime) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3230-ee1cd31d2b) ) #0 Wed Mar 1 11:10:06 2017
<7>[ 0.000000] MyLoader: sysp=2267fd7d, boardp=11fbfffe, parts=eb64bfd6
<6>[ 0.000000] bootconsole [early0] enabled
<6>[ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
<6>[ 0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
<6>[ 0.000000] Determined physical RAM map:
<6>[ 0.000000] memory: 04000000 @ 00000000 (usable)
<6>[ 0.000000] User-defined physical RAM map:
<6>[ 0.000000] memory: 04000000 @ 00000000 (usable)
<6>[ 0.000000] Initrd not found or empty - disabling initrd
<4>[ 0.000000] No valid device tree found, continuing without
<6>[ 0.000000] Zone ranges:
<6>[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
<6>[ 0.000000] Movable zone start for each node
<6>[ 0.000000] Early memory node ranges
<6>[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
<6>[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
<7>[ 0.000000] On node 0 totalpages: 16384
<7>[ 0.000000] free_area_init_node: node 0, pgdat 8040a3d0, node_mem_map 81000000
<7>[ 0.000000] Normal zone: 128 pages used for memmap
<7>[ 0.000000] Normal zone: 0 pages reserved
<7>[ 0.000000] Normal zone: 16384 pages, LIFO batch:3
<4>[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
<4>[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
<7>[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
<7>[ 0.000000] pcpu-alloc: [0] 0
<6>[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
<5>[ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 init=/etc/preinit board=OM2P-HSv4 root=31:04 mtdparts=spi0.0:256k(u-boot),256k(u-boot-env),1280k(custom),1536k(kernel),5632k(rootfs),7168k(inactive),256k(ART) mem=64M rootfstype=squashfs,jffs2 noinitrd
<6>[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
<6>[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
<6>[ 0.000000] Writing ErrCtl register=00000000
<6>[ 0.000000] Readback ErrCtl register=00000000
<6>[ 0.000000] Memory: 60164K/65536K available (2966K kernel code, 154K rwdata, 752K rodata, 280K init, 200K bss, 5372K reserved, 0K cma-reserved)
<6>[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
<6>[ 0.000000] NR_IRQS:51
<6>[ 0.000000] Clocks: CPU:650.000MHz, DDR:597.973MHz, AHB:216.666MHz, Ref:25.000MHz
<6>[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
<6>[ 0.000008] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
<6>[ 0.008213] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
<6>[ 0.071088] pid_max: default: 32768 minimum: 301
<6>[ 0.076072] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>[ 0.083050] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>[ 0.092952] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
<6>[ 0.104094] NET: Registered protocol family 16
<6>[ 0.110164] MIPS: machine is OpenMesh OM2P HSv4
<7>[ 0.117216] ar71xx: using random MAC address for eth0
<6>[ 0.564076] clocksource: Switched to clocksource MIPS
<6>[ 0.570703] NET: Registered protocol family 2
<6>[ 0.576075] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
<6>[ 0.583433] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
<6>[ 0.590188] TCP: Hash tables configured (established 1024 bind 1024)
<6>[ 0.596996] UDP hash table entries: 256 (order: 0, 4096 bytes)
<6>[ 0.603162] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
<6>[ 0.610056] NET: Registered protocol family 1
<7>[ 0.614737] PCI: CLS 0 bytes, default 32
<6>[ 0.618615] futex hash table entries: 256 (order: -1, 3072 bytes)
<4>[ 0.625194] Crashlog allocated RAM at address 0x3f00000
<6>[ 0.643803] squashfs: version 4.0 (2009/01/31) Phillip Lougher
<6>[ 0.650011] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
<6>[ 0.662708] io scheduler noop registered
<6>[ 0.666897] io scheduler deadline registered (default)
<6>[ 0.672501] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
<6>[ 0.679635] console [ttyS0] disabled
<6>[ 0.703533] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
<6>[ 0.712641] console [ttyS0] enabled
<6>[ 0.720195] bootconsole [early0] disabled
<6>[ 0.731604] m25p80 spi0.0: s25sl12800 (16384 Kbytes)
<5>[ 0.736838] 7 cmdlinepart partitions found on MTD device spi0.0
<5>[ 0.742950] Creating 7 MTD partitions on "spi0.0":
<5>[ 0.747915] 0x000000000000-0x000000040000 : "u-boot"
<5>[ 0.755177] 0x000000040000-0x000000080000 : "u-boot-env"
<5>[ 0.762169] 0x000000080000-0x0000001c0000 : "custom"
<5>[ 0.768893] 0x0000001c0000-0x000000340000 : "kernel"
<5>[ 0.775585] 0x000000340000-0x0000008c0000 : "rootfs"
<5>[ 0.782179] mtd: device 4 (rootfs) set to be root filesystem
<5>[ 0.788128] 1 squashfs-split partitions found on MTD device rootfs
<5>[ 0.794527] 0x000000540000-0x0000008c0000 : "rootfs_data"
<5>[ 0.801625] 0x0000008c0000-0x000000fc0000 : "inactive"
<5>[ 0.808490] 0x000000fc0000-0x000001000000 : "ART"
<6>[ 0.836596] libphy: ag71xx_mdio: probed
<6>[ 1.427011] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
<6>[ 1.437134] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
<6>[ 2.026616] ag71xx-mdio.1: Found an AR934X built-in switch
<6>[ 2.069912] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
<6>[ 2.078419] NET: Registered protocol family 10
<6>[ 2.087230] NET: Registered protocol family 17
<6>[ 2.091894] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
<6>[ 2.105087] 8021q: 802.1Q VLAN Support v1.8
<6>[ 2.116723] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
<6>[ 2.125584] Freeing unused kernel memory: 280K (8042a000 - 80470000)
<14>[ 3.047559] init: Console is alive
<14>[ 3.051280] init: - watchdog -
<14>[ 3.876010] init: - preinit -
<6>[ 4.352827] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
<5>[ 4.377282] random: procd: uninitialized urandom read (4 bytes read, 7 bits of entropy available)
<6>[ 6.617586] eth0: link up (100Mbps/Full duplex)
<6>[ 6.622302] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
<6>[ 7.165306] IPv6: eth0: IPv6 duplicate address fe80::ae86:74ff:fe82:9a50 detected!
<5>[ 7.678343] jffs2: notice: (339) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
<14>[ 7.695809] mount_root: switching to jffs2 overlay
<12>[ 7.712345] urandom-seed: Seeding with /etc/urandom.seed
<6>[ 7.880000] eth0: link down
<14>[ 7.892897] procd: - early -
<14>[ 7.896904] procd: - watchdog -
<14>[ 8.503616] procd: - ubus -
<5>[ 8.557970] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
<5>[ 8.568258] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
<5>[ 8.577628] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
<5>[ 8.587294] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
<5>[ 8.596640] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
<5>[ 8.606131] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
<5>[ 8.616005] random: ubusd: uninitialized urandom read (4 bytes read, 14 bits of entropy available)
<14>[ 8.625723] procd: - init -
<6>[ 8.901262] ip6_tables: (C) 2000-2006 Netfilter Core Team
<6>[ 8.917457] Loading modules backported from Linux version wt-2017-01-31-0-ge882dff19e7f
<6>[ 8.925787] Backport generated by backports.git backports-20160324-13-g24da7d3c
<6>[ 8.936244] ip_tables: (C) 2000-2006 Netfilter Core Team
<6>[ 8.949344] nf_conntrack version 0.5.0 (944 buckets, 3776 max)
<6>[ 8.986405] xt_time: kernel timezone is -0000
<6>[ 9.045279] PPP generic driver version 2.4.2
<6>[ 9.052017] NET: Registered protocol family 24
<7>[ 9.099822] ath: EEPROM regdomain: 0x0
<7>[ 9.099843] ath: EEPROM indicates default country code should be used
<7>[ 9.099852] ath: doing EEPROM country->regdmn map search
<7>[ 9.099872] ath: country maps to regdmn code: 0x3a
<7>[ 9.099882] ath: Country alpha2 being used: US
<7>[ 9.099890] ath: Regpair used: 0x3a
<7>[ 9.110315] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
<6>[ 9.114367] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=47
<5>[ 9.947094] random: jshn: uninitialized urandom read (4 bytes read, 16 bits of entropy available)
<5>[ 10.026842] random: ubusd: uninitialized urandom read (4 bytes read, 16 bits of entropy available)
<6>[ 14.433917] device eth1 entered promiscuous mode
<6>[ 14.453005] br-lan: port 1(eth1) entered forwarding state
<6>[ 14.458672] br-lan: port 1(eth1) entered forwarding state
<6>[ 14.496362] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
<6>[ 15.374126] br-lan: port 1(eth1) entered disabled state
<6>[ 16.947811] eth0: link up (100Mbps/Full duplex)
<6>[ 16.952532] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
<6>[ 17.485700] IPv6: eth0: IPv6 duplicate address fe80::ae86:74ff:fe82:9a50 detected!
<5>[ 73.484013] random: nonblocking pool is initialized
<1>[ 86.838964] Data bus error, epc == 83041ef8, ra == 83041ef4
<4>[ 86.844733] Oops[#1]:
<4>[ 86.847081] CPU: 0 PID: 941 Comm: ash Not tainted 4.4.50 #0
<4>[ 86.852841] task: 83984a10 ti: 82c50000 task.ti: 82c50000
<4>[ 86.858408] $ 0 : 00000000 779c3302 deadbeef 83041ec0
<4>[ 86.863837] $ 4 : b8109864 00009864 0007f000 00000000
<4>[ 86.869266] $ 8 : 0000a35c ffffffff 00000000 00000000
<4>[ 86.874697] $12 : ffffffff 00800000 00000000 ffffffff
<4>[ 86.880127] $16 : 0007f000 ffffffff 00009864 83085460
<4>[ 86.885557] $20 : 82c51dfc 00000018 833d4000 83366b78
<4>[ 86.890985] $24 : 00000000 8007d234
<4>[ 86.896415] $28 : 82c50000 82c51d70 00000000 83041ef4
<4>[ 86.901846] Hi : 00000001
<4>[ 86.904820] Lo : 00000000
<4>[ 86.907828] epc : 83041ef8 ath_start_rfkill_poll+0x54c/0x6a8 [ath9k]
<4>[ 86.914573] ra : 83041ef4 ath_start_rfkill_poll+0x548/0x6a8 [ath9k]
<4>[ 86.921307] Status: 1000f403 KERNEL EXL IE
<4>[ 86.925655] Cause : 1080001c (ExcCode 07)
<4>[ 86.929793] PrId : 00019374 (MIPS 24Kc)
<4>[ 86.933840] Modules linked in: ath9k ath9k_common pppoe ppp_async iptable_nat ath9k_hw ath pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_nat nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack iptable_mangle iptable_filter ip_tables crc_ccitt compat ip6t_REJECT nf_reject_ipv6 nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables x_tables gpio_button_hotplug
<4>[ 86.992849] Process ash (pid: 941, threadinfo=82c50000, task=83984a10, tls=779cdd48)
<4>[ 87.000835] Stack : 83085460 00000000 82c51dfc 00000018 833d4000 83b80010 00000003 83085460
<4>[ 87.000835] 00000000 83208268 83085460 83b80010 00000004 833d4000 83085460 833a4c00
<4>[ 87.000835] 83058010 8304c2e0 00000000 830474a0 83085460 00000001 833a4c00 83085460
<4>[ 87.000835] 833a4c00 83b80010 80400000 00000002 83084b40 8304f6f0 00000022 0000ffff
<4>[ 87.000835] 83984a00 00000002 00000001 83086034 00000000 00000000 00000000 310a3dd0
<4>[ 87.000835] ...
<4>[ 87.037824] Call Trace:
<4>[ 87.040363] [<83041ef8>] ath_start_rfkill_poll+0x54c/0x6a8 [ath9k]
<4>[ 87.046761] [<83041ef4>] ath_start_rfkill_poll+0x548/0x6a8 [ath9k]
<4>[ 87.053141]
<4>[ 87.054676]
<4>[ 87.054676] Code: 0c0722a3 00852021 00118827 <02221024> 8e6509bc 00508025 00b22821 0c0722a0 02002021
<4>[ 87.065050] ---[ end trace 850be6c44f1050af ]---

===================================
Time: 1488374342.423893
<4>[ 86.890985] $24 : 00000000 8007d234
<4>[ 86.896415] $28 : 82c50000 82c51d70 00000000 83041ef4
<4>[ 86.901846] Hi : 00000001
<4>[ 86.904820] Lo : 00000000
<4>[ 86.907828] epc : 83041ef8 ath_start_rfkill_poll+0x54c/0x6a8 [ath9k]
<4>[ 86.914573] ra : 83041ef4 ath_start_rfkill_poll+0x548/0x6a8 [ath9k]
<4>[ 86.921307] Status: 1000f403 KERNEL EXL IE
<4>[ 86.925655] Cause : 1080001c (ExcCode 07)
<4>[ 86.929793] PrId : 00019374 (MIPS 24Kc)
<4>[ 86.933840] Modules linked in: ath9k ath9k_common pppoe ppp_async iptable_nat ath9k_hw ath pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_nat nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack iptable_mangle iptable_filter ip_tables crc_ccitt compat ip6t_REJECT nf_reject_ipv6 nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables x_tables gpio_button_hotplug
<4>[ 86.992849] Process ash (pid: 941, threadinfo=82c50000, task=83984a10, tls=779cdd48)
<4>[ 87.000835] Stack : 83085460 00000000 82c51dfc 00000018 833d4000 83b80010 00000003 83085460
<4>[ 87.000835] 00000000 83208268 83085460 83b80010 00000004 833d4000 83085460 833a4c00
<4>[ 87.000835] 83058010 8304c2e0 00000000 830474a0 83085460 00000001 833a4c00 83085460
<4>[ 87.000835] 833a4c00 83b80010 80400000 00000002 83084b40 8304f6f0 00000022 0000ffff
<4>[ 87.000835] 83984a00 00000002 00000001 83086034 00000000 00000000 00000000 310a3dd0
<4>[ 87.000835] ...
<4>[ 87.037824] Call Trace:
<4>[ 87.040363] [<83041ef8>] ath_start_rfkill_poll+0x54c/0x6a8 [ath9k]
<4>[ 87.046761] [<83041ef4>] ath_start_rfkill_poll+0x548/0x6a8 [ath9k]
<4>[ 87.053141]
<4>[ 87.054676]
<4>[ 87.054676] Code: 0c0722a3 00852021 00118827 <02221024> 8e6509bc 00508025 00b22821 0c0722a0 02002021
<4>[ 87.065050] ---[ end trace 850be6c44f1050af ]---
<0>[ 87.071512] Fatal exception: panic in 5 seconds
<0>[ 92.083905] Kernel panic - not syncing: Fatal exception