R1D2 wrote

Most certainly it's not VLAN 11, but Default_VLAN 1, since VLAN 1 uses only untagged frames in your setting, even on the trunk port (due to its PVID=1, which designates VLAN 1 as the native VLAN, in which all other ports are members of, too). Upgrade to latest (2018) firmware to be able to remove ports from the Default_VLAN. But I can't say wether the Bufallo passes tagged frames over a mesh WiFi.

R1D2 wrote

If you get a connection from a trunk port to an access port, but not vice versa, it's almost certainly the famous and well-known VLAN 1 problem of those switches.

The problem is that all ports are by default always untagged members of Default_VLAN 1. For access ports, untagged frames will get tagged by the switch on ingress using its PVID and untagged on egress. Problem with the Default_VLAN: even access ports are members of two VLANs: the one the port is assigned to as a member (say, 11, PVID 11) and the Default_VLAN 1. Therefore, even frames with VID 1 will be forwarded to any port on egress and the tag will be stripped.

However, on trunk ports the behavior is different: tagged frames on ingress are forwarded unchanged. Untagged frames on ingress will get tagged with the primary VLAN, defined in the trunk's Primary VLAN ID (PVID). But if a frame with a tag equal to the trunk's Primary VLAN will be forwarded by the switch to the trunk port for egress, its VLAN tag will also be stripped on egress, since the trunk port is an untagged member of the Default_VLAN, which is the same as the Primary VLAN if PVID=1. This Default_VLAN is also sometimes called native VLAN and it exist to ensure that even untagged frames arriving on a trunk port will get forwarded. Nothing bad, but it often causes much confusion, especially if ports cannot be removed from such a native/default VLAN.

In other words: all access and trunk ports are sharing the Default_VLAN 1 as the VLAN for untagged traffic arriving on trunk ports whose PVID is 1.

If you upgraded the firmware to the latest one (December 2017, published in January 2018), you can remove ports from the Default_VLAN using the web UI of the switch (not the EZ Config Utility!). This way, no untagged frames arriving on the trunk port will be forwarded to other access ports anymore. But wether your Buffalo sends untagged frames, which then will end up in the trunk's Primary VLAN is something you still have to test. Anyway, we did fight hard for nearly one year with TP-Link to get this firmware update for Easy Smart switches finally, so try this step to see wether the effects you described will disappear.

As for VLAN passing over WiFi links:
Usually, WiFi routers pass VLAN tags over WiFi, at least if operating as bridges. But some WiFi adapters are well known to strip VLAN tags before encapsulating Ethernet frames in WiFi frames to avoid problems with the MTU. I never tested VLAN passing with Buffalos, so you have to find out for yourself.