scp / wifi / hairpin problem

I'm running into a strange problem, and I'm hoping someone has a suggestion for how to debug it.

My home network consists of:

• the router: a Linux box with two ethernet ports, one connected to the LAN, the other to a cable modem
• two wifi APs (Mikrotik), connected to the LAN via ethernet
• a Linux desktop system, connected via ethernet
• a Linux laptop, normally connected via wifi

The router port-forwards ssh connections from the internet to the Linux desktop. It also has a hairpin route from the LAN, so I can ssh from my laptop using the external address, regardless of whether I'm at home or out.

This has all been working fine for years. Recently, I upgraded a couple things (Linux kernel on the laptop, RouterOS on the Mikrotik wifi APs), and now scp from the laptop to the desktop fails with:
Code:client_loop: send disconnect: Broken pipe
lost connectionThe really weird part is that sftp works, and interactive ssh also works fine and is 100% stable. If I switch the laptop from wifi to ethernet (but still using the hairpin route), then scp works. Scp to the desktop's LAN address (avoiding the hairpin route) also works.

I'm not expecting anyone to immediately know what's wrong, but does someone have a suggestion for an approach to debugging this?