More updates:
The packet issues I was having were partially solved by turning on hairpin mode for each wireless AP NIC that gets assigned to the main Ethernet bridge. Do not turn on hairpin mode for the RTL8152/8153 though, they will choke in seconds! But ultimately that still didn’t completely fix issues with KDE connect, mdns, and other UDP based things on my LAN.
As wifi 7 features like MLO just don’t seem to be coming to hostapd any time soon, I broke down and bought off the shelf routers to use as APs instead. I tried the TPLink BE3600 first, which would have been just fine for our needs. But then the BE9300 went on sale for the same price over Black Friday, so I switched to that instead. Grabbed a Wavlink branded USB3 hub with 2.5gig Ethernet nic, which cost $33 IIRC. Unfortunately it has an RTL8153 in it also, so I’ve kept up my “turn off scatter gather and offloaded CRC checking” routine. 2.3Gbps iperf3 throughput between that Wavlink and the BE9300. ~1.3Gbps wireless throughput to a Be200 wlan nic in my daily driver laptop. Range is decent from the BE9300 too, goes about 25m through 4 wood stud walls to the opposite corner of the house, with 300+ Mbps actual throughout even that far.
I would not want to run this is my primary router / firewall for reasons, but as a standalone AP both of the TP-Link units I tried would be just fine for small office home use. KDE connect, mdns, etc are all working perfectly now, and my girl is happier that the Internet doesn’t go out at 2am on her anymore…