I tested and check the driver. Here is the thing.

Where there are multiple virtual interfaces, the wifi driver “rt28xx” only support minor (last 7 bit) change of the MAC address, compared to the permanent MAC address, which is loaded from flash when system start.

So you cannot change the MAC address freely when the wifi driver is loaded. The permanent MAC address is in mtd2. So if you compile your own firmware, you can keep this mtd partition unlocked. You can then change the mac address and write it back. Then reload the wifi driver.