Tailscale subnet router flapping on kernel upgrade

After upgrading our Debian 12 nodes from 6.1 to 6.8 LTS, the Tailscale subnet-router container started flapping every 4-6 hours. Logs show the daemon re-authenticating but the route advertisements never propagate to the control plane. Restarting the container fixes it temporarily. Kernel version: 6.8.0-117-generic, Tailscale 1.76.6 running in Docker with --cap-add=NET_ADMIN and /dev/net/tun mounted. Same config worked fine on 6.1 for 8 months. Has anyone hit this after a kernel bump? Wondering if it's an nftables/iptables conflict or something in the wireguard-go layer.