Hey, I got a repro and a fix 
with both my routers, after writing the crash partition and enabling telnet with your clever hack, my routers are in factory mode : no password needed for telnet and reset button does not do anything except showing a message on the console "BUTTON:reset ACTION:pressed".
without a way to use reset, I cannot but any other router in netmode 4
here is a fix:
deleting the crash partition from telnet with
`mtd erase crash
fixed it , I could then use the reset button to switch the other router to netmode 4, and perform the procedure.
I then needed the password calculated from the serial number to perform the upgrade this router.
Thanks again for the help, I hope my experience with help others as well if you want to include it in your instructions.