Is the same address always used for "struct ath10k *ar = hw->priv" -- even when driver is stopped / bus errors are encountered? If not this could potentially be use after free scenario? Most code tries to protect the ->state with the config mutex, might need to do that here too
