Well, there are two ways:
Try to find out what they did in u-boot. Probably wrote to some register. If we find that out, we can revert it. But this is tricky I guess. We can try to flash an old u-boot from the stock firmware that has this 'mac spoofing' bug. Most likely all will work with it.
A second way is to find out why it works on the 4.9 kernel and older openwrt versions.
it works on 4.14 too, for ar71xx target, there was a PR with 4.14 and I made an image
Yup, so what is the real change in the driver that's the question.
@xabolcs if you want an flowofload image with kernel 4.14 try this one, I think I shared the good one, please test if is 4.14
Thanks!
Sure, I'm really curious about flow-offload PPPoE performance on this old hardware! 
Saved, tried, it is 4.14, but wanted to see a working ath79 target! 
By the way, port 4 doesn't work - no link. Other ports: WAN, LAN1-3 works as they should.
[ 0.000000] Linux version 4.14.50 (build@build) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r6744-751746c736)) #0 Sat Jun 23 14:06:31 2018
[ 0.000000] MyLoader: sysp=ffffffff, boardp=fffff7df, parts=bfffffff
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Atheros AR9132 rev 2
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000001ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000001ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[ 0.000000] On node 0 totalpages: 8192
[ 0.000000] free_area_init_node: node 0, pgdat 804e3dc0, node_mem_map 81000020
[ 0.000000] Normal zone: 64 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 8192 pages, LIFO batch:0
[ 0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 8128
[ 0.000000] Kernel command line: board=TL-WR1043ND console=ttyS0,115200 rootfstype=squashfs noinitrd
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 26896K/32768K available (3582K kernel code, 181K rwdata, 864K rodata, 292K init, 212K bss, 5872K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:40.000MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns
[ 0.000012] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns
[ 0.007895] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[ 0.094148] pid_max: default: 32768 minimum: 301
[ 0.099062] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.105662] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.115393] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.125261] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.131952] NET: Registered protocol family 16
[ 0.138136] MIPS: machine is TP-LINK TL-WR1043ND
[ 0.446569] clocksource: Switched to clocksource MIPS
[ 0.452955] NET: Registered protocol family 2
[ 0.458376] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.465347] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.471761] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.478313] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.484151] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.490765] NET: Registered protocol family 1
[ 0.495146] PCI: CLS 0 bytes, default 32
[ 0.499961] Crashlog allocated RAM at address 0x1f00000
[ 0.506444] workingset: timestamp_bits=30 max_order=13 bucket_order=0
[ 0.519659] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.525474] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.544499] io scheduler noop registered
[ 0.548483] io scheduler deadline registered (default)
[ 0.554005] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.560883] console [ttyS0] disabled
[ 0.584489] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 12500000) is a 16550A
[ 0.593190] console [ttyS0] enabled
[ 0.600210] bootconsole [early0] disabled
[ 0.612505] m25p80 spi0.0: found s25sl064p, expected m25p80
[ 0.618237] m25p80 spi0.0: s25sl064p (8192 Kbytes)
[ 0.624070] 5 tp-link partitions found on MTD device spi0.0
[ 0.629726] Creating 5 MTD partitions on "spi0.0":
[ 0.634554] 0x000000000000-0x000000020000 : "u-boot"
[ 0.640555] 0x000000020000-0x00000019faf4 : "kernel"
[ 0.646459] 0x00000019faf4-0x0000007f0000 : "rootfs"
[ 0.652477] mtd: device 2 (rootfs) set to be root filesystem
[ 0.658285] 1 squashfs-split partitions found on MTD device rootfs
[ 0.664507] 0x000000430000-0x0000007f0000 : "rootfs_data"
[ 0.670887] 0x0000007f0000-0x000000800000 : "art"
[ 0.676539] 0x000000020000-0x0000007f0000 : "firmware"
[ 0.683183] Realtek RTL8366RB ethernet switch driver version 0.2.4
[ 0.806585] rtl8366rb rtl8366rb: using GPIO pins 18 (SDA) and 19 (SCK)
[ 0.813325] rtl8366rb rtl8366rb: RTL5937 ver. 3 chip found
[ 1.053580] libphy: rtl8366rb: probed
[ 1.058129] libphy: Fixed MDIO Bus: probed
[ 1.398416] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:RGMII
[ 1.406886] NET: Registered protocol family 10
[ 1.415918] Segment Routing with IPv6
[ 1.419815] NET: Registered protocol family 17
[ 1.424925] 8021q: 802.1Q VLAN Support v1.8
[ 1.434806] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 1.443746] Freeing unused kernel memory: 292K
[ 1.448252] This architecture does not have kernel memory protection.
[ 2.337123] init: Console is alive
[ 2.340809] init: - watchdog -
[ 2.536599] random: fast init done
[ 4.018294] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 4.107064] usbcore: registered new interface driver usbfs
[ 4.112674] usbcore: registered new interface driver hub
[ 4.118220] usbcore: registered new device driver usb
[ 4.129731] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 4.147266] SCSI subsystem initialized
[ 4.156842] ehci-platform: EHCI generic platform driver
[ 4.162219] ehci-platform ehci-platform: EHCI Host Controller
[ 4.168064] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[ 4.176162] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[ 4.206613] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[ 4.213930] hub 1-0:1.0: USB hub found
[ 4.218164] hub 1-0:1.0: 1 port detected
[ 4.227542] usbcore: registered new interface driver usb-storage
[ 4.234616] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.244312] init: - preinit -
[ 5.124936] ar71xx: pll_reg 0xb8050014: 0x1a000000
[ 5.124959] eth0: link up (1000Mbps/Full duplex)
[ 5.157037] random: procd: uninitialized urandom read (4 bytes read)
[ 8.347147] jffs2: notice: (395) jffs2_build_xattr_subsystem: complete building xattr subsystem, 3 of xdatum (0 unchecked, 1 orphan) and 3 of xref (1 dead, 0 orphan) found.
[ 8.364274] mount_root: switching to jffs2 overlay
[ 8.406835] overlayfs: upper fs does not support tmpfile.
[ 8.422304] urandom-seed: Seeding with /etc/urandom.seed
[ 8.716951] eth0: link down
[ 8.734472] procd: - early -
[ 8.737998] procd: - watchdog -
[ 9.302915] procd: - watchdog -
[ 9.306409] procd: - ubus -
[ 9.454511] random: ubusd: uninitialized urandom read (4 bytes read)
[ 9.621508] random: ubusd: uninitialized urandom read (4 bytes read)
[ 9.628535] random: ubusd: uninitialized urandom read (4 bytes read)
[ 9.636100] procd: - init -
[ 10.022642] kmodloader: loading kernel modules from /etc/modules.d/*
[ 10.035772] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 10.057147] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180
[ 10.065207] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d
[ 10.075736] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 10.092519] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[ 10.157464] usbcore: registered new interface driver r8152
[ 10.192420] xt_time: kernel timezone is -0000
[ 10.268587] PPP generic driver version 2.4.2
[ 10.276031] NET: Registered protocol family 24
[ 10.369168] ath: EEPROM regdomain: 0x0
[ 10.369180] ath: EEPROM indicates default country code should be used
[ 10.369185] ath: doing EEPROM country->regdmn map search
[ 10.369201] ath: country maps to regdmn code: 0x3a
[ 10.369208] ath: Country alpha2 being used: US
[ 10.369213] ath: Regpair used: 0x3a
[ 10.410349] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[ 10.414948] ieee80211 phy0: Atheros AR9100 MAC/BB Rev:7 AR2133 RF Rev:a2 mem=0xb80c0000, irq=2
[ 10.567986] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 11.908607] urandom_read: 5 callbacks suppressed
[ 11.908618] random: jshn: uninitialized urandom read (4 bytes read)
[ 24.799017] ar71xx: pll_reg 0xb8050014: 0x1a000000
[ 24.799891] eth0: link up (1000Mbps/Full duplex)
[ 24.804685] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 24.862678] br-lan: port 1(eth0.1) entered blocking state
[ 24.868196] br-lan: port 1(eth0.1) entered disabled state
[ 24.874036] device eth0.1 entered promiscuous mode
[ 24.878914] device eth0 entered promiscuous mode
[ 24.937298] br-lan: port 1(eth0.1) entered blocking state
[ 24.942753] br-lan: port 1(eth0.1) entered forwarding state
[ 24.948665] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[ 25.856813] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 25.864131] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 118.246300] random: crng init done
My U-Boot is from the latest stock firmware, and it blocks the switch if I try an ath79 target:
# grep U-Boot /dev/mtd0
U-Boot 1.1.4 (Mar 19 2014 - 11:06:29)
U-Boot
You can do us a favor. Can you install some old stock firmware with older u-boot.
You first need to flash a stock firmware without u-boot over openwrt, then you can downgrade your stock one.
After that flash ath79 openwrt and check.
Sure, but I don't have serial access, so I would test those versions which have automatic tftp recovery only! 
I didn't know that automatic tftp recovery is available for this device in stock firmware.
I guess this won't work, because I remember when they fixed to spoofing. At that time there was no recovery.
I have to do it myself then. I know where to find old stock firmware.
BTW what is the stock firmware version with tftp recovery?
The latest has it: TL-WR1043ND_V1_140319
V1 FW download page: https://www.tp-link.com/us/download/TL-WR1043ND_V1.html#Firmware
And which one doesn't have it? I guess all those at the site have tftp?
Will check soon!
You should know (at least from OpenWrt Wiki ) that those TP-Link routers are trying tftp to 192.168.0.66:
root@OpenWrt:~# grep setenv /dev/mtd0
setenv serverip 192.168.0.66
setenv ipaddr 192.168.0.86
setenv
setenv - set environment variables
setenv name
But the bootloader part in the firmware file is compressed in lzma + squashfs, so it should be extracted or flashed. The firmware file is grep compatible, no compression or other magic is applied.
So funny. I have the same u-boot as you have. But I didn't even try to tftp recover.
But this doesn't mean much. I tryed to recover mr3040. It has tfrt, it even loads the firmware, but doesn't flash it.
The TL-WR1043NDv1 didn't originally have tftp push-button recovery, it was only retrofitted in pretty late OEM firmware (u-boot) upgrades (around 2013).
Bad news!
The older ones (TL-WR1043ND_V1_130325.zip and TL-WR1043ND_v1_130428.zip) doesn't have that awesome recovery function. 
I won't try them with ath79 images for now, sorry!
U-Boot 1.1.4 (Mar 19 2014 - 11:06:29) this one has it.
It is safe enough, because Wi-Fi works, but I understand you concern.
I'll probably test some old one from year '10 or '11.