Kicking the watchdog inside a timer interrupt is almost the same as having no watchdog at all. Usually when the code runs away the interrupt keeps ticking.

Further you read a multibyte variable that gets updated by the ISR. This can give the LSB before and the MSB after the interrupt (or vice versa) with weird values at LSB overflow. You should make that atomic by disabling the interrupt around it.

And on top of that you also modify this variable in both places. You should extend the atomic operation to include the clearing as well.