So I can confirm that the uboot bootloader is stored on flash, as is the squashfs filesystem. But the device just refuses to handover to the uboot on disk. If I catch the pre-boot FTP server and send it uboot, then it will load openwrt from the local filesystem. dmesg output is:
[ 0.000000] Linux version 5.4.119 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16122-c2139eef27)) #0 SMP Fri May 28 14:04:04 2021
[ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[ 0.000000] CPU: div instructions available: patching division code
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] OF: fdt: Machine model: AVM FRITZ!Box 7530
[ 0.000000] Memory policy: Data cache writealloc
[ 0.000000] On node 0 totalpages: 65024
[ 0.000000] Normal zone: 576 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 65024 pages, LIFO batch:15
[ 0.000000] percpu: Embedded 15 pages/cpu s30156 r8192 d23092 u61440
[ 0.000000] pcpu-alloc: s30156 r8192 d23092 u61440 alloc=15*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 64448
[ 0.000000] Kernel command line:
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 248620K/260096K available (5777K kernel code, 188K rwdata, 872K rodata, 1024K init, 241K bss, 11476K reserved, 0K cma-reserved, 0K highmem)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[ 0.000000] random: get_random_bytes called from 0xc0a00bbc with crng_init=0
[ 0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[ 0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[ 0.000022] Switching to timer-based delay loop, resolution 20ns
[ 0.000235] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[ 0.000251] pid_max: default: 32768 minimum: 301
[ 0.000450] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.000468] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.001444] CPU: Testing write buffer coherency: ok
[ 0.002445] Setting up static identity map for 0x80300000 - 0x80300060
[ 0.002581] rcu: Hierarchical SRCU implementation.
[ 0.003026] smp: Bringing up secondary CPUs ...
[ 0.006080] smp: Brought up 1 node, 4 CPUs
[ 0.006099] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[ 0.006108] CPU: All CPU(s) started in SVC mode.
[ 0.010382] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[ 0.010532] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.010558] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.010761] pinctrl core: initialized pinctrl subsystem
[ 0.011752] NET: Registered protocol family 16
[ 0.012021] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.013191] cpuidle: using governor ladder
[ 0.013237] cpuidle: using governor menu
[ 0.017950] GPIO line 461 (enable USB3 power) hogged as output/high
[ 0.032805] cryptd: max_cpu_qlen set to 1000
[ 0.036082] usbcore: registered new interface driver usbfs
[ 0.036150] usbcore: registered new interface driver hub
[ 0.036206] usbcore: registered new device driver usb
[ 0.036253] pps_core: LinuxPPS API ver. 1 registered
[ 0.036262] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.036288] PTP clock support registered
[ 0.036976] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 0.038000] clocksource: Switched to clocksource arch_sys_counter
[ 0.038777] thermal_sys: Registered thermal governor 'step_wise'
[ 0.039057] NET: Registered protocol family 2
[ 0.039218] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.039969] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[ 0.040013] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[ 0.040129] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.040179] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.040310] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.040348] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.040603] NET: Registered protocol family 1
[ 0.040644] PCI: CLS 0 bytes, default 64
[ 0.042445] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[ 0.048061] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.048077] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.098146] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[ 0.100204] qcom-pcie 40000000.pci: host bridge /soc/pci@40000000 ranges:
[ 0.100254] qcom-pcie 40000000.pci: IO 0x40200000..0x402fffff -> 0x40200000
[ 0.100292] qcom-pcie 40000000.pci: MEM 0x40300000..0x40ffffff -> 0x40300000
[ 0.379571] qcom-pcie 40000000.pci: Link up
[ 0.379732] qcom-pcie 40000000.pci: PCI host bridge to bus 0000:00
[ 0.379753] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 0.379771] pci_bus 0000:00: root bus resource [io 0x0000-0xfffff] (bus address [0x40200000-0x402fffff])
[ 0.379786] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff]
[ 0.379827] pci 0000:00:00.0: [17cb:1001] type 01 class 0x060400
[ 0.379865] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[ 0.379936] pci 0000:00:00.0: PME# supported from D0 D3hot
[ 0.381362] PCI: bus0: Fast back to back transfers disabled
[ 0.381563] pci 0000:01:00.0: [8086:09a9] type 00 class 0x028000
[ 0.381688] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x007fffff]
[ 0.382177] pci 0000:01:00.0: supports D1 D2
[ 0.382191] pci 0000:01:00.0: PME# supported from D0 D1 D3hot D3cold
[ 0.383721] PCI: bus1: Fast back to back transfers disabled
[ 0.383770] pci 0000:00:00.0: BAR 8: assigned [mem 0x40800000-0x40ffffff]
[ 0.383789] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff]
[ 0.383810] pci 0000:01:00.0: BAR 0: assigned [mem 0x40800000-0x40ffffff]
[ 0.383840] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[ 0.383857] pci 0000:00:00.0: bridge window [mem 0x40800000-0x40ffffff]
[ 0.386599] pcieport 0000:00:00.0: AER: enabled with IRQ 94
[ 0.388347] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[ 0.388366] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[ 0.389629] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[ 0.389721] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[ 0.389802] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[ 0.389887] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[ 0.390205] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.391997] msm_serial 78af000.serial: msm_serial: detected port #0
[ 0.392043] msm_serial 78af000.serial: uartclk = 1843200
[ 0.392100] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 24, base_baud = 115200) is a MSM
[ 0.392128] msm_serial: console setup on port #0
[ 1.032432] printk: console [ttyMSM0] enabled
[ 1.037344] msm_serial: driver initialized
[ 1.046187] loop: module loaded
[ 1.047586] nand: device found, Manufacturer ID: 0x98, Chip ID: 0xf1
[ 1.048431] nand: Toshiba NAND 128MiB 3,3V 8-bit
[ 1.054971] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 1.059683] 11 fixed-partitions partitions found on MTD device qcom_nand.0
[ 1.066949] Creating 11 MTD partitions on "qcom_nand.0":
[ 1.073838] 0x000000000000-0x000000080000 : "SBL1"
[ 1.080716] 0x000000080000-0x000000100000 : "MIBIB"
[ 1.085203] 0x000000100000-0x000000180000 : "QSEE"
[ 1.090071] 0x000000180000-0x0000001c0000 : "CDT"
[ 1.094643] 0x0000001c0000-0x000000240000 : "QSEE_B"
[ 1.099673] 0x000000240000-0x000000280000 : "urlader0"
[ 1.104389] 0x000000280000-0x0000002c0000 : "urlader1"
[ 1.109414] 0x0000002c0000-0x000000b00000 : "nand-tffs"
[ 1.122196] 0x000000b00000-0x000000f00000 : "uboot0"
[ 1.126899] 0x000000f00000-0x000001300000 : "uboot1"
[ 1.128263] random: fast init done
[ 1.134542] 0x000001300000-0x000008000000 : "ubi"
[ 1.241431] libphy: ipq4019_mdio: probed
[ 1.266443] ESS reset ok!
[ 1.290585] ESS reset ok!
[ 1.710495] libphy: Fixed MDIO Bus: probed
[ 1.718948] i2c /dev entries driver
[ 1.720838] sdhci: Secure Digital Host Controller Interface driver
[ 1.721243] sdhci: Copyright(c) Pierre Ossman
[ 1.727489] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.735269] NET: Registered protocol family 10
[ 1.738896] Segment Routing with IPv6
[ 1.741982] NET: Registered protocol family 17
[ 1.745686] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 1.750027] 8021q: 802.1Q VLAN Support v1.8
[ 1.763144] Registering SWP/SWPB emulation handler
[ 1.776794] UBI: auto-attach mtd10
[ 1.776833] ubi0: attaching mtd10
[ 2.552709] ubi0: scanning is finished
[ 2.569872] ubi0: attached mtd10 (name "ubi", size 109 MiB)
[ 2.569911] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 2.574258] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 2.581254] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 2.588107] ubi0: good PEBs: 871, bad PEBs: 1, corrupted PEBs: 0
[ 2.594831] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[ 2.601112] ubi0: max/mean erase counter: 29/16, WL threshold: 4096, image sequence number: 359334324
[ 2.608140] ubi0: available PEBs: 0, total reserved PEBs: 871, PEBs reserved for bad PEB handling: 19
[ 2.617437] ubi0: background thread "ubi_bgt0d" started, PID 104
[ 2.618730] block ubiblock0_1: created from ubi0:1(rootfs)
[ 2.632708] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem
[ 2.638013] hctosys: unable to open rtc device (rtc0)
[ 2.650830] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[ 2.652435] Freeing unused kernel memory: 1024K
[ 2.678237] Run /sbin/init as init process
[ 3.108754] init: Console is alive
[ 3.108978] init: - watchdog -
[ 3.376327] random: crng init done
[ 3.732807] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 3.994280] dwc3-qcom 8af8800.usb3: IRQ hs_phy_irq not found
[ 3.994319] dwc3-qcom 8af8800.usb3: IRQ dp_hs_phy_irq not found
[ 3.999050] dwc3-qcom 8af8800.usb3: IRQ dm_hs_phy_irq not found
[ 4.004671] dwc3-qcom 8af8800.usb3: IRQ ss_phy_irq not found
[ 4.012630] dwc3 8a00000.dwc3: Failed to get clk 'ref': -2
[ 4.143281] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[ 4.143445] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[ 4.148385] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f665 hci version 0x100 quirks 0x0000000002010010
[ 4.155473] xhci-hcd xhci-hcd.0.auto: irq 98, io mem 0x08a00000
[ 4.165526] hub 1-0:1.0: USB hub found
[ 4.170598] hub 1-0:1.0: 1 port detected
[ 4.174679] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[ 4.178483] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[ 4.183725] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
[ 4.193915] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[ 4.198453] hub 2-0:1.0: USB hub found
[ 4.206151] hub 2-0:1.0: 1 port detected
[ 4.211865] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.224186] init: - preinit -
[ 8.661687] UBIFS (ubi0:2): Mounting in unauthenticated mode
[ 8.661900] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 191
[ 8.704769] UBIFS (ubi0:2): recovery needed
[ 8.854646] UBIFS (ubi0:2): recovery completed
[ 8.855050] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[ 8.858160] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 8.865947] UBIFS (ubi0:2): FS size: 99803136 bytes (95 MiB, 786 LEBs), journal size 4952064 bytes (4 MiB, 39 LEBs)
[ 8.875935] UBIFS (ubi0:2): reserved for root: 4713948 bytes (4603 KiB)
[ 8.886139] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID 4D69C5C8-4D36-4DB0-9D37-108BB66C783D, small LPT model
[ 8.902490] mount_root: switching to ubifs overlay
[ 8.922243] urandom-seed: Seeding with /etc/urandom.seed
[ 9.004693] procd: - early -
[ 9.004804] procd: - watchdog -
[ 9.599801] procd: - watchdog -
[ 9.609244] procd: - ubus -
[ 9.695798] procd: - init -
[ 10.440301] kmodloader: loading kernel modules from /etc/modules.d/*
[ 10.483978] urngd: v1.0.2 started.
[ 10.515151] Loading modules backported from Linux version v5.10.34-0-g0aa66717f684
[ 10.515190] Backport generated by backports.git v5.10.34-1-0-g7b5533e1
[ 10.532812] xt_time: kernel timezone is -0000
[ 10.561634] PPP generic driver version 2.4.2
[ 10.562489] NET: Registered protocol family 24
[ 11.718545] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[ 11.718595] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[ 11.730071] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[ 11.811611] ath10k_ahb a000000.wifi: board_file api 2 bmi_id 0:20 crc32 e2dfaa91
[ 13.099032] ath10k_ahb a000000.wifi: 10.4 wmi init: vdevs: 16 peers: 48 tid: 96
[ 13.099083] ath10k_ahb a000000.wifi: msdu-desc: 2500 skid: 32
[ 13.134531] ath10k_ahb a000000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186 msdu-desc: 2500 sw-crypt: 0 ct-sta: 0'
[ 13.135516] ath10k_ahb a000000.wifi: wmi print 'free: 53252 iram: 13432 sram: 35752'
[ 13.320414] ath10k_ahb a000000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[ 13.571893] ath: EEPROM regdomain sanitized
[ 13.571905] ath: EEPROM regdomain: 0x64
[ 13.571911] ath: EEPROM indicates we should expect a direct regpair map
[ 13.571922] ath: Country alpha2 being used: 00
[ 13.571926] ath: Regpair used: 0x64
[ 13.998520] ath10k_ahb a800000.wifi: loading /lib/firmware/ath10k/pre-cal-ahb-a800000.wifi.bin failed with error -22
[ 14.506995] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[ 14.507051] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[ 14.519894] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[ 14.547368] ath10k_ahb a800000.wifi: failed to fetch board data for bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=AVM-FRITZBox-75 from ath10k/QCA4019/hw1.0/board-2.bin
[ 14.618990] ath10k_ahb a800000.wifi: failed to fetch board-2.bin or board.bin from ath10k/QCA4019/hw1.0
[ 14.619038] ath10k_ahb a800000.wifi: failed to fetch board file: -12
[ 14.627222] ath10k_ahb a800000.wifi: could not probe fw (-12)
[ 14.638381] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 19.510255] br-lan: port 1(eth0) entered blocking state
[ 19.510301] br-lan: port 1(eth0) entered disabled state
[ 19.514720] device eth0 entered promiscuous mode
[ 20.568174] br-lan: port 1(eth0) entered blocking state
[ 20.568219] br-lan: port 1(eth0) entered forwarding state
[ 20.572753] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
It refuses to boot normally though, and for some reason it doesn't recognise the 5Ghz radio. Perhaps this LM variant is unsupported?
The above is from 21.02rc2, but I've tried various versions including 19.07.8 (none see the second radio)