tc egress mirror to tunnel causing hard lock

When I apply an egress mirror to a GRE or VXLAN tunnel, the Linux host
locks up requiring a hard restart. I have tried Ubuntu and Debian. The
ingress snippet works fine. I can apply the ingress and egress
statements to a dummy or second real interface and everything works so
it seems to be an issue with tunnels. Am I missing something or is
this expected behavior?

ip tunnel add tun0 mode gre remote 172.20.0.6 local 172.20.0.10 ttl 255
ip link set tun0 up
ip addr add 192.168.0.2/24 dev tun0


# Ingress
tc qdisc add dev ens33 ingress
tc filter add dev ens33 parent ffff: \
    protocol all \
    u32 match u8 0 0 \
    action mirred egress mirror dev tun0

# Egress
tc qdisc add dev ens33 handle 100: root prio
# The following causes the system to lock up if applied to a tunnel,
in this case tun0
tc filter add dev ens33 parent 100: \
    protocol all \
    u32 match u8 0 0 \
    action mirred egress mirror dev tun0