So, I soldered up a serial port, and tried using the option '2'. Seems it is quite unhappy:
2: Load System code then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.1) ==:
Input server IP (192.168.1.70) ==:
Input Linux Kernel filename (RT-AC58U.trx) ==:lede-ipq806x-RT-AC58U-squashfs-flash-factory.trx
preferred nic: eth0
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 up Speed :1000 Full duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
switch prereq:0
Using eth0 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'lede-ipq806x-RT-AC58U-squashfs-flash-factory.trx'.
Load address: 0x84000000
Loading: Got ARP REPLY, set eth addr (80:ee:73:36:fd:10)
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############
done
Bytes transferred = 12570688 (bfd040 hex)
NetBootFileXferSize= 00bfd040
0xbfd000 bytes written to volume linux
0xbfd000 bytes written to volume linux2
No valid image found at 0x84000040
ERROR: can't get kernel image!
Read 0x40 bytes from volume [linux2] offset 0x0 to 84000000
No valid 2nd firmware found at 0x030ae000
ERROR: can't get kernel image!
data abort
pc : [<87303834>] lr : [<87301678>]
sp : 86edfd30 ip : a8a0f57d fp : 00003055
r10: 8736ec94 r9 : 00000000 r8 : 86edff68
r7 : 873585b7 r6 : 000000c8 r5 : 00314067 r4 : 69666e6f
r3 : 00000083 r2 : 0a000021 r1 : 0000000a r0 : 00000001
Flags: nzCv IRQs off FIQs off Mode SVC_32
Resetting CPU ...
resetting ...
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1338 - bootable_media_detect_entry, Start
B - 1678 - bootable_media_detect_success, Start
B - 1692 - elf_loader_entry, Start
B - 5068 - auth_hash_seg_entry, Start
B - 7210 - auth_hash_seg_exit, Start
B - 572127 - elf_segs_hash_verify_entry, Start
B - 687050 - PBL, End
B - 687075 - SBL1, Start
B - 775408 - pm_device_init, Start
D - 6 - pm_device_init, Delta
B - 776918 - boot_flash_init, Start
D - 54264 - boot_flash_init, Delta
B - 835369 - boot_config_data_table_init, Start
D - 3845 - boot_config_data_table_init, Delta - (419 Bytes)
B - 842590 - clock_init, Start
D - 7564 - clock_init, Delta
B - 854675 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B - 858164 - sbl1_ddr_set_params, Start
B - 863150 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 867642 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13146 - sbl1_ddr_set_params, Delta
B - 881342 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 951667 - sbl1_wait_for_ddr_training, Start
D - 29 - sbl1_wait_for_ddr_training, Delta
B - 966963 - Image Load, Start
D - 134908 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 1102367 - Image Load, Start
D - 1443 - SEC Image Loaded, Delta - (2048 Bytes)
B - 1112734 - Image Load, Start
D - 223363 - APPSBL Image Loaded, Delta - (457299 Bytes)
B - 1336519 - QSEE Execution, Start
D - 59 - QSEE Execution, Delta
B - 1342781 - SBL1, End
D - 657709 - SBL1, Delta
S - Flash Throughput, 2007 KB/s (721870 Bytes, 359581 us)
S - DDR Frequency, 537 MHz
U-Boot 2012.07-05763-g80e4eb4 [local,local] (Jul 06 2016 - 11:01:57)
RT-AC58U bootloader version: 1.0.0.3
smem ram ptable found: ver: 1 len: 3
ASUS RT-AC58U gpio init : wps / reset pin
DRAM: 128 MiB
machid : 0x8010100
Maximum malloc length: 4096 KBytes
mem_malloc_start/brk/end: 0x86ef0000/86ef0000/87300000
Relocation offset: 0
NAND: spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:aa:21
SF: Detected W25N01GV with page size 2 KiB, total 128 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
name : offset size
0:SBL1 : 00000000 00040000
0:MIBIB : 00040000 00020000
0:QSEE : 00060000 00060000
0:CDT : 000c0000 00010000
0:DDRPARAMS : 000d0000 00010000
0:APPSBLENV : 000e0000 00010000
0:APPSBL : 000f0000 00080000
0:ART : 00170000 00010000
machid: 8010100
Net: MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Creating 1 MTD partitions on "nand1":
0x00000000-0x08000000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: max. sequence number: 904
UBI: attached mtd2 to ubi0
UBI: MTD device name: "mtd=0"
UBI: MTD device size: 128 MiB
UBI: number of good PEBs: 1024
UBI: number of bad PEBs: 0
UBI: number of corrupted PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 6
UBI: available PEBs: 30
UBI: total number of reserved PEBs: 994
UBI: number of PEBs reserved for bad PEB handling: 10
UBI: max/mean erase counter: 25/1
UBI: image sequence number: 1117443911
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corruptede
UBI: 0 3 1 0 dynamic 1f000 3 5d000 1f000 0m
UBI: 1 1 1 0 dynamic 1f000 1 1f000 1f000 0y
UBI: 2 1 1 0 dynamic 1f000 1 1f000 1f000 02
UBI: 3 18d 1 0 dynamic 1f000 18d 3013000 1f000 0x
UBI: 4 18d 1 0 dynamic 1f000 18d 3013000 1f000 02
UBI: 5 b5 1 0 dynamic 1f000 b5 15eb000 1f000 02
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0e
Read 0x1f000 bytes from volume [Factory] offset 0x0 to 86ec0ce8
EEPROM set 0: OK (version 21)
Read 0x1f000 bytes from volume [Factory2] offset 0x0 to 86ec0ce8
EEPROM set 1: OK (version 21)
Read 0x1f000 bytes from volume [Factory] offset 0x0 to 86ef3480
Select EEPROM set 0 at offset 0x0.
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
0
3: Boot System code via Flash (default).
RT-AC58U bootloader version: 1.0.0.3
MAC Address: 88:D7:F6:A9:48:B0
Read 0x40 bytes from volume [linux] offset 0x0 to 84000000
No valid 1st firmware found at 0x0009b000
ERROR: can't get kernel image!
Read 0x40 bytes from volume [linux2] offset 0x0 to 84000000
No valid 2nd firmware found at 0x030ae000
ERROR: can't get kernel image!
Hello!! Enter Recuse Mode: (Check error)
preferred nic: eth0
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 up Speed :1000 Full duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
switch prereq:0
tftpd start
Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
D D D D D D D D D D D D D D D D D D D D
CTRL-A Z for help | 115200 8N1 | NOR | Minicom 2.7