You can find mine and @soxrok2212 work of yesterday night in my staging tree. TF-A and U-Boot work quite good already, in Linux Ethernet is not working yet, but at least MT7531 and both RTL8221 2.5G PHYs already probe and seem to be detected. All userspace board detection and default configuration magic is still entirely missing. LEDs and buttons are also still missing.
Edit: Installation notes:
Use exploit to gain root shell, transfer files below to /tmp with nc, use md5sum to validate them. Then:
dd if=/tmp/openwrt-mediatek-filogic-tplink_xdr6086-preloader.bin of=/dev/mtdblock9 bs=131072 conv=sync
1+1 records in
2+0 records out
dd if=/tmp/openwrt-mediatek-filogic-tplink_xdr6086-bl31-uboot.fip of=/dev/mtdblock9 bs=131072 conv=sync seek=28
7+1 records in
8+0 records out
Fortunately mtd9 seems to represent the whole SPI-NAND chip without BMT, so writing to mtd9 allows us to truly know the raw/hardware address we are writing to.