diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
index 4f0fb5f69d0..22269277da0 100644
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mt76
-PKG_RELEASE=1
+PKG_RELEASE=2
 
 PKG_LICENSE:=GPLv2
 PKG_LICENSE_FILES:=
diff --git a/package/kernel/mt76/patches/0007-wifi-mt76-mt7603-fix-tx-queue-of-loopback-packets.patch b/package/kernel/mt76/patches/0007-wifi-mt76-mt7603-fix-tx-queue-of-loopback-packets.patch
new file mode 100644
index 00000000000..56a2aea6f69
--- /dev/null
+++ b/package/kernel/mt76/patches/0007-wifi-mt76-mt7603-fix-tx-queue-of-loopback-packets.patch
@@ -0,0 +1,99 @@
+From e4de3592c4e3baa82142eff583cb5a761f790709 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 2 Apr 2024 20:14:34 +0200
+Subject: [PATCH] wifi: mt76: mt7603: fix tx queue of loopback packets
+
+Use the correct WMM AC queue instead of the MGMT one to fix potential issues
+with aggregation sequence number tracking. Drop non-bufferable packets.
+
+Fixes: fca9615f1a43 ("mt76: mt7603: fix up hardware queue index for PS filtered packets")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ mt7603/dma.c | 46 ++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 14 deletions(-)
+
+--- a/mt7603/dma.c
++++ b/mt7603/dma.c
+@@ -4,6 +4,13 @@
+ #include "mac.h"
+ #include "../dma.h"
+ 
++static const u8 wmm_queue_map[] = {
++	[IEEE80211_AC_BK] = 0,
++	[IEEE80211_AC_BE] = 1,
++	[IEEE80211_AC_VI] = 2,
++	[IEEE80211_AC_VO] = 3,
++};
++
+ static void
+ mt7603_rx_loopback_skb(struct mt7603_dev *dev, struct sk_buff *skb)
+ {
+@@ -22,10 +29,10 @@ mt7603_rx_loopback_skb(struct mt7603_dev
+ 	struct ieee80211_sta *sta;
+ 	struct mt7603_sta *msta;
+ 	struct mt76_wcid *wcid;
++	u8 tid = 0, hwq = 0;
+ 	void *priv;
+ 	int idx;
+ 	u32 val;
+-	u8 tid = 0;
+ 
+ 	if (skb->len < MT_TXD_SIZE + sizeof(struct ieee80211_hdr))
+ 		goto free;
+@@ -42,19 +49,36 @@ mt7603_rx_loopback_skb(struct mt7603_dev
+ 		goto free;
+ 
+ 	priv = msta = container_of(wcid, struct mt7603_sta, wcid);
+-	val = le32_to_cpu(txd[0]);
+-	val &= ~(MT_TXD0_P_IDX | MT_TXD0_Q_IDX);
+-	val |= FIELD_PREP(MT_TXD0_Q_IDX, MT_TX_HW_QUEUE_MGMT);
+-	txd[0] = cpu_to_le32(val);
+ 
+ 	sta = container_of(priv, struct ieee80211_sta, drv_priv);
+ 	hdr = (struct ieee80211_hdr *)&skb->data[MT_TXD_SIZE];
+-	if (ieee80211_is_data_qos(hdr->frame_control))
++
++	hwq = wmm_queue_map[IEEE80211_AC_BE];
++	if (ieee80211_is_data_qos(hdr->frame_control)) {
+ 		tid = *ieee80211_get_qos_ctl(hdr) &
+-		      IEEE80211_QOS_CTL_TAG1D_MASK;
+-	skb_set_queue_mapping(skb, tid_to_ac[tid]);
++			 IEEE80211_QOS_CTL_TAG1D_MASK;
++		u8 qid = tid_to_ac[tid];
++		hwq = wmm_queue_map[qid];
++		skb_set_queue_mapping(skb, qid);
++	} else if (ieee80211_is_data(hdr->frame_control)) {
++		skb_set_queue_mapping(skb, IEEE80211_AC_BE);
++		hwq = wmm_queue_map[IEEE80211_AC_BE];
++	} else {
++		skb_pull(skb, MT_TXD_SIZE);
++		if (!ieee80211_is_bufferable_mmpdu(skb))
++			goto free;
++		skb_push(skb, MT_TXD_SIZE);
++		skb_set_queue_mapping(skb, MT_TXQ_PSD);
++		hwq = MT_TX_HW_QUEUE_MGMT;
++	}
++
+ 	ieee80211_sta_set_buffered(sta, tid, true);
+ 
++	val = le32_to_cpu(txd[0]);
++	val &= ~(MT_TXD0_P_IDX | MT_TXD0_Q_IDX);
++	val |= FIELD_PREP(MT_TXD0_Q_IDX, hwq);
++	txd[0] = cpu_to_le32(val);
++
+ 	spin_lock_bh(&dev->ps_lock);
+ 	__skb_queue_tail(&msta->psq, skb);
+ 	if (skb_queue_len(&msta->psq) >= 64) {
+@@ -151,12 +175,6 @@ static int mt7603_poll_tx(struct napi_st
+ 
+ int mt7603_dma_init(struct mt7603_dev *dev)
+ {
+-	static const u8 wmm_queue_map[] = {
+-		[IEEE80211_AC_BK] = 0,
+-		[IEEE80211_AC_BE] = 1,
+-		[IEEE80211_AC_VI] = 2,
+-		[IEEE80211_AC_VO] = 3,
+-	};
+ 	int ret;
+ 	int i;
+ 
diff --git a/package/kernel/mt76/patches/0008-wifi-mt76-mt7603-add-wpdma-tx-eof-flag-for-PSE-clien.patch b/package/kernel/mt76/patches/0008-wifi-mt76-mt7603-add-wpdma-tx-eof-flag-for-PSE-clien.patch
new file mode 100644
index 00000000000..31c4de4a0f0
--- /dev/null
+++ b/package/kernel/mt76/patches/0008-wifi-mt76-mt7603-add-wpdma-tx-eof-flag-for-PSE-clien.patch
@@ -0,0 +1,24 @@
+From 446f652c967c11d50d9005e2acec97f8b577bb92 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 3 Apr 2024 11:11:54 +0200
+Subject: [PATCH] wifi: mt76: mt7603: add wpdma tx eof flag for PSE client
+ reset
+
+This flag is needed for the PSE client reset. Fixes watchdog reset issues.
+
+Fixes: c677dda16523 ("wifi: mt76: mt7603: improve watchdog reset reliablity")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ mt7603/mac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mt7603/mac.c
++++ b/mt7603/mac.c
+@@ -1393,6 +1393,7 @@ void mt7603_pse_client_reset(struct mt76
+ 		   MT_CLIENT_RESET_TX_R_E_2_S);
+ 
+ 	/* Start PSE client TX abort */
++	mt76_set(dev, MT_WPDMA_GLO_CFG, MT_WPDMA_GLO_CFG_FORCE_TX_EOF);
+ 	mt76_set(dev, addr, MT_CLIENT_RESET_TX_R_E_1);
+ 	mt76_poll_msec(dev, addr, MT_CLIENT_RESET_TX_R_E_1_S,
+ 		       MT_CLIENT_RESET_TX_R_E_1_S, 500);