BCM63138 based router jailbreak

Hi, everyone! I've got BCM63138 chip based router that looks like this:

I have UART connected to the device. (unfortunately, I couldn't find JTAG on board). Device itself goes into infinite reboot with 'power' led blinking when it reaches certain point. I wounder if there is some kind of watchdog that does it.
So far I've got access to truncated CFE where I dumped nvme (0x000000000000-0x000000040000 : "nvram") and image_update with rootfs (ubifs+jffs2) (0x000000040000-0x0x00000818000).

I'm looking for suggestions about this device, as I have lack of experience with embedded systems.
Is it possible to reimage either CFE with extended feature set or rootfs, so it can boots successfully ?

I have managed to load random file into device via tftp, but I couldn't figure out how to run some thing on the device. It seems like if I execute 'go' command in CFE it just stuck and does nothing, or I give it wrong offset....
There are available CFE commands:

CFE> h
Invalid command: "h"
Available commands: x, find, comp, fb, dn, phy, otpr, sm, db, dh, dw, w, e, wp, ws, go, r, p, c, i, ddr, a, b, reset, pmdio, spi, closeavs, cpufreq, force, help

*** command status = -1
CFE> help
Available commands:

x                   Change extra partitions size
find                Find string in NAND
comp                Compare NAND blocks
fb                  Find NAND bad blocks
dn                  Dump NAND contents along with spare area-1
phy                 Set memory or registers.
otpr                Read btrm otp bits
sm                  Set memory or registers.
db                  Dump bytes.
dh                  Dump half-words.
dw                  Dump words.
w                   Write the whole image start from beginning of the flash
e                   Erase NAND flash
wp                  Write pmc (previously loaded through JTAG to flash block 0.
ws                  Write whole image (priviously loaded by kermit or JTAG) to flash .
go                  goto and execute from specefic address.
r                   Run program from flash image or from host depend on [f/h] flag
p                   Print boot line and board parameter info
c                   Change booline parameters
i                   Erase persistent storage data
ddr                 Change board DDR config
a                   Change board AFE ID
b                   Change board parameters
reset               Reset the board
pmdio               Pseudo MDIO access for external switches.
spi                 Legacy SPI access of external switch.
closeavs            pmc close avs cmd
cpufreq             set CPU frequency
force               override chipid check for images.
help                Obtain help for CFE commands

Memory map:

0x000008500000-0x0000102c0000 : "rootfs"
0x000000580000-0x000008180000 : "rootfs_update"
0x00001fb00000-0x00001ff00000 : "user"
0x000000000000-0x000000040000 : "nvram"
0x000008180000-0x0000102c0000 : "image"
0x000000040000-0x000008180000 : "image_update"
0x000008180000-0x000008500000 : "bootfs"
0x000000040000-0x000000580000 : "bootfs_update"
0x00001fa00000-0x00001fb00000 : "misc2"
0x000010300000-0x00001fa00000 : "misc1"

I will attach bootlog from both images that device has:
Image_0 bootlog:

Image_1 bootlog:

Device made by KAON Media company (http://www.kaonmedia.com/eng/product/pro02_2.asp?pgrp=41)
They don't have any updates available for it (DG3420), but device itself looks like (DG2100B) and I have no idea if they are compatible...

Both file.io links give a 404. Did something go wrong there?

I assume wireless radios will be Broadcom as well on your device, support is hit and miss for those.

I don't know what happened with file.io, it was working yesterday. I uploaded bootlogs in files.fm instead and I hope it will work.

As I can see there are only 2 options to flash something by using either 'w' to reprogram whole flash, or 'ws', 'wp' to program something that was preloaded. There is also a web access to CFE, but I suppose it uses the same commands as there are no other commands available.

It would be nice to make it run some custom program first...