After a few months of playing with Xiaomi AX3600 I managed to break it beyond my unbricking skills. Following mistakenly restored incorrect config backup it produces only that:
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00147
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2735 - bootable_media_detect_entry, Start
B - 3442 - bootable_media_detect_success, Start
B - 3447 - elf_loader_entry, Start
B - 6110 - auth_hash_seg_entry, Start
B - 6353 - auth_hash_seg_exit, Start
B - 68463 - elf_segs_hash_verify_entry, Start
B - 131159 - PBL, End
B - 144387 - SBL1, Start
B - 197030 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 203587 - pm_device_init, Start
B - 325984 - PM_SET_VAL:Skip
D - 121725 - pm_device_init, Delta
B - 328241 - pm_driver_init, Start
D - 5337 - pm_driver_init, Delta
B - 334768 - clock_init, Start
D - 2135 - clock_init, Delta
B - 338733 - boot_flash_init, Start
D - 11895 - boot_flash_init, Delta
B - 354410 - boot_config_data_table_init, Start
D - 3172 - boot_config_data_table_init, Delta - (575 Bytes)
B - 361943 - Boot Setting : 0x00000600
B - 365878 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:16
B - 372801 - sbl1_ddr_set_params, Start
B - 376614 - CPR configuration: 0x300
B - 380091 - cpr_init, Start
B - 382897 - Rail:0 Mode: 5 Voltage: 816000
B - 388051 - CL CPR settled at 768000mV
B - 390857 - Rail:1 Mode: 5 Voltage: 880000
B - 395036 - Rail:1 Mode: 7 Voltage: 912000
D - 16470 - cpr_init, Delta
B - 401929 - Pre_DDR_clock_init, Start
B - 405955 - Pre_DDR_clock_init, End
B - 409340 - DDR Type : PCDDR3
B - 414952 - do ddr sanity test, Start
D - 1067 - do ddr sanity test, Delta
B - 419802 - DDR: Start of HAL DDR Boot Training
B - 424529 - DDR: End of HAL DDR Boot Training
B - 430233 - DDR: Checksum to be stored on flash is 1817814633
B - 440633 - Image Load, Start
B - 441426 - Error code 1000001 at boot_config.c Line 280
Wound be interesting to know how o.o
It seems a bug in the bootloader...
I really think this "shit" have a download mode but no idea how to trigger that and how to pass a correct bin... Worth askin for a replacement since this is totally a device defect...
Hi, have you found any solution for your solid brick? I have a AX6 solid brick too. In my case the bootloader does not look like corrupted but Ethernet interfaces don't get up properly and the tftp recovery method does not work. More details of my special case here: https://forum.openwrt.org/t/xiaomi-ax3600-bricked/106300/70
If we only have a NAND backup solution, the calibration data is unique for each device? In my case almost NAND partitions must be OK, Is it possible to recover the ART and other special partitions before re-format the NAND with an external programmer?
What I can see in the bootlog the problem start with WLAN initialization. Could be that the problem is due to a physical damage of wireless module? The device lost 5GHz capability a few days before got bricked and I tried to update to new firmware version to see if 5GHz starting working again with not success. After a new update or a factory reset (I cannot remember it exactly) I got a beautiful and cool brick. Also, when I opened the AX6 to connect TTL, I saw one of the four 5GHz antennas half un-soldered, I fix that but not success again.
Or could be this the strange BUG in this bootloader? The MAC address is wrong. (The MAC should be 64:64:4a:XX:0a:XX)
...
Hit any key to stop autoboot: 0
detect button press, continue check 5 secs
detect button pressed 5 secs !
confirm to launch xq_upgrade !
cmd=dhcp
Net: MAC0 addr:64:64:4a:XX:a:XX <---******* Could be this a bug?? The MAC should be 64:64:4a:XX:0a:XX ********
PHY ID1: 0x4d
PHY ID2: 0xd0b1
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq807x_edma_alloc_rings: successfull
ipq807x_edma_setup_ring_resources: successfull
ipq807x_edma_configure_rings: successfull
ipq807x_edma_hw_init: successfull
board_eth_init: ipq807x_edma_init successed
eth0
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :10 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
eth0 PHY5 Down Speed :10 Half duplex
ipq807x_eth_init: done
BOOTP broadcast 1
BOOTP broadcast 2
...
Thanks you, sure, I was lucky and I got almost full refund but... I have this white brick looking at me every day and I would like to discard any option available to recover this good piece of hardware. The device worked almost fine for two days in relay mode (5GHz) with original stock firmware because that I have some hope that can be recoverable... ,at least, like a gigabit router-switch if the wireless is damaged.
but... I have this white brick looking at me every day 
and I would like to discard any option available to recover this good piece of hardware. The device worked almost fine for two days in relay mode (5GHz) with original stock firmware because that I have some hope that can be recoverable... ,at least, like a gigabit router-switch if the wireless is damaged.