Flashing Unifi 6 Lite fails. Flash read only?

I'm following the guide here: https://openwrt.org/toh/ubiquiti/unifi_6_lite#installation
Nothing obvious fails, I write the firmware to the two partitions, reboot and then I just land back in the stock firmware.
I noticed first time around I accidentally flashed the upgrade binary instead of the kernel binary.
Not sure if that would normally brick a device but if the two kernel partitions hold the stock firmware normally then I assume that I'm somehow prevented from writing to these partitions?
Is there something that might keep the flash in read only that I'm missing?

The AP is currently provisioned with a Unifi Controller. Could that prevent something?

Here is my fw_printenv output after following the instructions.

U6-Lite-BZ.6.2.44# fw_printenv
appinitdone=true
baudrate=115200
ble_mode=serial
bootdelay=2
device_model=U6-LITE
ethact=eth@1e100000
ethaddr=78:45:58:69:cb:c8
fdtcontroladdr=8ffeced0
fw_version=9.9.9
is_ble_stp=true
macaddr=78:45:58:69:cb:c8
netmask=255.255.255.0
serverip=192.168.1.19
stderr=uartlite0@1e000c00
stdin=uartlite0@1e000c00
stdout=uartlite0@1e000c00
ubntaddr=850000a0
ipaddr=192.168.1.20
devmode=TRUE
boot_openwrt=fdt addr $(fdtcontroladdr); fdt rm /signature; bootubnt
bootcmd=run boot_openwrt
is_default=false

And flashing:

U6-Lite-BZ.6.2.44# ls
blebr.cert
blebr.key
cfg
openwrt-22.03.3-ramips-mt7621-ubnt_unifi-6-lite-initramfs-kernel.bin
U6-Lite-BZ.6.2.44# dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4
1+0 records in
1+0 records out
U6-Lite-BZ.6.2.44# dd if=openwrt-22.03.3-ramips-mt7621-ubnt_unifi-6-lite-initramfs-kernel.bin of=/dev/mtdblock6
11202+1 records in
11202+1 records out
U6-Lite-BZ.6.2.44# dd if=openwrt-22.03.3-ramips-mt7621-ubnt_unifi-6-lite-initramfs-kernel.bin of=/dev/mtdblock7
11202+1 records in
11202+1 records out
U6-Lite-BZ.6.2.44#