[X] I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
[X] I have searched the issue tracker for a similar issue and not found a similar issue.
General issue report
In mesh_netif.c,
functions mesh_driver_start_root_ap() and mesh_driver_start_node_sta(), the callback function driver_free_rx_buffer is initialized to the function mesh_free() which, in turn, forwards all calls to the heap-based free().
The actual ESP-WIFI-MESH esp_netif initialization configures the driver_free_rx_buffer callback to the function wifi_free() in wifi_netif.c. This correct function forwards all calls to esp_wifi_internal_free_rx_buffer().
It therefore appears highly likely that buffer-free operations may release Rx buffers onto the wrong free-list, corrupting the WiFi buffer-management facility.
Answers checklist.
General issue report
In mesh_netif.c, functions mesh_driver_start_root_ap() and mesh_driver_start_node_sta(), the callback function driver_free_rx_buffer is initialized to the function mesh_free() which, in turn, forwards all calls to the heap-based free().
The actual ESP-WIFI-MESH esp_netif initialization configures the driver_free_rx_buffer callback to the function wifi_free() in wifi_netif.c. This correct function forwards all calls to esp_wifi_internal_free_rx_buffer().
It therefore appears highly likely that buffer-free operations may release Rx buffers onto the wrong free-list, corrupting the WiFi buffer-management facility.