For a debug test, I decided to switch to Async mode of scanning, and that eventually hangs also.
n = WiFi.scanNetworks(/async/true, /hidden/true, /passive/false, ms_per_chan);
I put this into a loop with a delay and poll the status, and after about 5 min of scanning and completing, the WiFi.scanNetworks() function even in async mode hangs. I would expect it to return -1 (Running) or -2 (failed) but instead it blocks forever.