With 438af9698b0f161286c6e5d24255c3c231988b39 I can reproduce the bug. And testing 

commit cfbc6c4c5b91c7725ef14465b98ac347d31f2334
Author: Sara Sharon <email address hidden>
Date:   Tue Aug 21 15:23:39 2018 +0300

    iwlwifi: mvm: support mac80211 TXQs model

produces this error:

[   59.121470] WARNING: CPU: 1 PID: 2458 at drivers/net/wireless/intel/iwlwifi/mvm/tx.c:1102 iwl_mvm_tx_mpdu+0x2e2/0x540 [iwlmvm]
[   59.121478] Modules linked in: cmac rfcomm bnep btusb btrtl btbcm btintel bluetooth hp_wmi ecdh_generic wmi_bmof kvm_amd ccp kvm irqbypass crc32_pclmul joydev aesni_intel iwlmvm uvcvideo mac80211 aes_x86_64 videobuf2_vmalloc crypto_simd videobuf2_memops cryptd glue_helper videobuf2_v4l2 videodev snd_hda_codec_conexant psmouse snd_hda_codec_generic ledtrig_audio videobuf2_common snd_hda_codec_hdmi iwlwifi fam15h_power k10temp snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core i2c_piix4 snd_pcm hid_logitech_hidpp snd_timer cfg80211 snd realtek soundcore r8169 rfkill libphy wmi hp_wireless hid_logitech_dj rtsx_pci_sdmmc mmc_core ehci_pci ehci_hcd xhci_pci xhci_hcd rtsx_pci efivarfs autofs4
[   59.121536] CPU: 1 PID: 2458 Comm: ssh Not tainted 5.0.0-rc1-00028-gcfbc6c4c5b91 #20
[   59.121539] Hardware name: HP HP ProBook 645 G2/80FE, BIOS N77 Ver. 01.37 01/04/2019
[   59.121546] RIP: 0010:iwl_mvm_tx_mpdu+0x2e2/0x540 [iwlmvm]
[   59.121549] Code: 74 24 18 a8 08 0f 85 35 02 00 00 0f b6 4c 24 18 41 8b 55 00 4c 63 f9 f6 c2 40 74 6e 4b 8d 04 bf 83 bc c3 74 01 00 00 03 74 60 <0f> 0b 48 8b bf a0 00 00 00 48 8b 34 24 41 bc ff ff ff ff e8 26 7d
[   59.121551] RSP: 0018:ffffa7db89463688 EFLAGS: 00010293
[   59.121553] RAX: 0000000000000005 RBX: ffffa356afd4a820 RCX: 0000000000000001
[   59.121555] RDX: 0000000040000050 RSI: 0000000000000001 RDI: ffffa3575c700028
[   59.121557] RBP: ffffa35752e415a8 R08: 0000000000000008 R09: ffffa3575d7fd684
[   59.121558] R10: 0000000000000008 R11: 0000000000004188 R12: ffffa3575d7f0500
[   59.121560] R13: ffffa7db89463728 R14: 0000000000004188 R15: 0000000000000001
[   59.121562] FS:  00007f0b28994740(0000) GS:ffffa3576f280000(0000) knlGS:0000000000000000
[   59.121564] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   59.121565] CR2: 00002604a2adaa80 CR3: 000000031bde8000 CR4: 00000000001406e0
[   59.121567] Call Trace:
[   59.121577]  ? __local_bh_enable_ip+0x35/0x80
[   59.121584]  iwl_mvm_tx_skb+0x1aa/0x500 [iwlmvm]
[   59.121590]  iwl_mvm_mac_itxq_xmit+0x61/0x90 [iwlmvm]
[   59.121608]  ieee80211_queue_skb+0x229/0x3a0 [mac80211]
[   59.121620]  ieee80211_tx+0xd4/0x130 [mac80211]
[   59.121632]  __ieee80211_subif_start_xmit+0x70f/0xbc0 [mac80211]
[   59.121636]  ? __bpf_prog_run32+0x34/0x60
[   59.121641]  ? skb_send_sock_locked+0x200/0x200
[   59.121643]  ? reqsk_fastopen_remove+0x150/0x150
[   59.121654]  ieee80211_subif_start_xmit+0x3e/0x2d0 [mac80211]
[   59.121658]  ? dev_queue_xmit_nit+0x247/0x250
[   59.121661]  dev_hard_start_xmit+0x90/0x210
[   59.121664]  __dev_queue_xmit+0x755/0x8d0
[   59.121668]  ? __cgroup_bpf_run_filter_skb+0x156/0x200
[   59.121672]  ip_finish_output2+0x271/0x3c0
[   59.121675]  ip_output+0x6b/0x110
[   59.121679]  __ip_queue_xmit+0x158/0x420
[   59.121683]  __tcp_transmit_skb+0x538/0xa40
[   59.121686]  tcp_write_xmit+0x373/0xfd0
[   59.121689]  __tcp_push_pending_frames+0x2d/0xc0
[   59.121692]  tcp_sendmsg_locked+0x4b6/0xcd0
[   59.121695]  tcp_sendmsg+0x23/0x40
[   59.121698]  sock_sendmsg+0x34/0x40
[   59.121702]  sock_write_iter+0x8a/0xf0
[   59.121706]  __vfs_write+0x138/0x190
[   59.121710]  vfs_write+0xb1/0x190
[   59.121712]  ksys_write+0x4a/0xb0
[   59.121715]  do_syscall_64+0x50/0x170
[   59.121719]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   59.121722] RIP: 0033:0x7f0b2889a828
[   59.121724] Code: 00 90 48 83 ec 38 64 48 8b 04 25 28 00 00 00 48 89 44 24 28 31 c0 48 8d 05 b5 7e 0d 00 8b 00 85 c0 75 27 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 60 48 8b 4c 24 28 64 48 33 0c 25 28 00 00 00
[   59.121726] RSP: 002b:00007ffeb88e9a80 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   59.121728] RAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f0b2889a828
[   59.121729] RDX: 0000000000004024 RSI: 000055f759ad2d10 RDI: 0000000000000003
[   59.121731] RBP: 000055f759a760e0 R08: 00007f0b27f5a000 R09: 0000000000000000
[   59.121732] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000003b
[   59.121734] R13: 0000000000000000 R14: 000000007fffffff R15: 00007ffeb88e9b18
[   59.121737] ---[ end trace 83442b1426970953 ]---