A station wakeup drains its power-save queue once, while frames
redirected by the PSE can still be waiting on the MCU RX ring. Processing
those loopbacks after the wakeup queues them for an already awake station
and sets the driver's buffered indication again. The stale frames remain
queued until another service period or sleep/wake transition drains them.

Check ps_sleeping under ps_lock before buffering a loopback, and publish
the buffered indication under the same lock. The wakeup's state change
and queue drain use that lock too, so late frames cannot repopulate the
queue or leave a stale buffered indication after the wakeup.

Discard late frames rather than retransmitting their old sequence and
packet numbers after newer traffic or a wakeup BAR. This loses the late
frame; it does not recover delivery. Use the station's sleep state, not
the temporary hardware PS bypass used during U-APSD service periods.

Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
Assisted-by: LLM
Signed-off-by: Cristian Papa <pcristian292@gmail.com>
---
Based on Linux master 4056b3c9d3c92ea45955641dbafeb9b960e146ef.
The ps_sleeping field comes from mt76 commit 276db249c20a, corresponding
to Linux commit 636a883e2fee ("wifi: mt76: mt7603: restore hardware PS
buffering after a service period"). Older trees need that prerequisite.

Testing: extracted C functions from the unmodified base reproduce both a
late queue insertion and a buffered-notification race in a host harness.
The candidate passes these cases and controls for sleeping U-APSD clients,
frame formats, queue limit and malformed frames under ASan/UBSan. MMIO,
mac80211 services and locks are modeled. The changed source builds as a
MIPS object with W=1 and -Werror against Linux 6.18.44/backports 7.2.

Tested on MT7603E (TP-Link Archer XR500v, mt76 backported to Linux
6.18.44): a phone on the 2.4 GHz AP went through three 60 s screen-off/wake
cycles with a 1 Hz ping from the AP running throughout (about 8 minutes).
All 474 pings were answered, the phone never reassociated, and there were
no resets or kernel warnings. This exercises the power-save path under
traffic but does not demonstrate the late-loopback race itself, since no
counter records discarded late frames.

AI assistance: Codex reviewed the late-loopback path, proposed the change,
prepared the patch text, and implemented/ran host regression checks after
being asked to review pending power-save fixes and their upstream fit.

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
--- a/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/dma.c
@@ -72,7 +72,6 @@
 	}
 
 	skb->priority = tid;
-	ieee80211_sta_set_buffered(sta, tid, true);
 
 	val = le32_to_cpu(txd[0]);
 	val &= ~(MT_TXD0_P_IDX | MT_TXD0_Q_IDX);
@@ -80,6 +79,13 @@
 	txd[0] = cpu_to_le32(val);
 
 	spin_lock_bh(&dev->ps_lock);
+	/* The wake-up may have drained psq before this loopback arrived. */
+	if (!msta->ps_sleeping) {
+		spin_unlock_bh(&dev->ps_lock);
+		goto free;
+	}
+
+	ieee80211_sta_set_buffered(sta, tid, true);
 	__skb_queue_tail(&msta->psq, skb);
 	if (skb_queue_len(&msta->psq) >= 64) {
 		skb = __skb_dequeue(&msta->psq);