I tried patching the current uboot (analysing it with ghidra), first by changing the '?' command to point to what appears to be the do_bootm function (which unfortunately has some modifications WRT the canonical implementation), then by patching the check for a valid and signed image, so far with no success.
Does anyone know if the GPL sources for uboot for this device are available, so that a compatible uboot can be built?
I see in the download page for this architecture (both in the release and snapshot) that uboot is provided only for several models of fritzbox, maybe an uboot for this device could be provided so that openwrt can be installed.
There is no need do use additional hardware, apboot can write to the SPI flash.