I forgot that running from RAM is an option, I'll definitely try that out first. What stumped me at first was that the operating system is stored on eMMC instead of SPI flash like how it was on U6 lite. In fact, that was what motivated me to open the thing because cat /proc/mtd only showed two entries, none of which stores the kernel:
U6-Plus-BZ.6.5.28# cat /proc/mtd
dev: size erasesize name
mtd0: 00010000 00010000 "EEPROM"
mtd1: 00080000 00010000 "u-boot-env"
But I can worry about that after I get something other than stock booted on the device.
As for the device tree, I was able to scp -r ubnt@192.168.1.20:/proc/device-tree . onto my development machine and did dtc -I fs -O dts device-tree. It appears to work, I'll provide it in a separate post. I plan to diff this with this commit and go from there.