Hi,
I just installed Open WRT 24.10.1 on an "old" WRT610N v1 router which was previously using version 23.05.5
I flashed the firmware (bin file from https://downloads.openwrt.org/releases/24.10.1/targets/bcm47xx/generic/openwrt-24.10.1-bcm47xx-generic-linksys_wrt610n-v1-squashfs.bin) and chose not to keep previous settings.
My device is now keeping rebooting. It appears quickly at address 192.168.1.1 then reboots again...
How can I re install the previous version ?
Thank you 
That is probably happening because the 24.10.1 image is using the b43 driver, per the following:
[OpenWrt Wiki] Linksys WRT610N
Normally when OpenWRT is installed and you choose not to keep prior settings, wifi is disabled.
With broadcom devices, if you run the b43 driver and enable it on the 5ghz radio, bootlooping is often the result.
Most likely something in yours is enabling the 5Ghz radio.
You can attempt to get it into the recovery web interface using the instructions in the above link. I strongly recommend you use that interface to put factory firmware back on it then per instructions, build the 24.10.1 image using wl instead of b43 and use that image.
That is not possible, there is no broadcom-wl in OpenWrt anymore, the package and all surrounding support has been removed way before 24.10.x (and had already been broken for quite a while longer). It's either b43 or nothing. From my experience, the WRT610Nv1 probably needs serial access to recover, as its CFE implementation is buggy (wrong (way too small) upload size limit).
Thank you for your answers.
I was able to unbrick my router by soldering a connector to use the serial port.
The endless loop is caused by a kernel panic:
[ 3.141501] Data bus error, epc == 80012fc0, ra == 800106ec
[ 3.147213] Oops[#1]:
[ 3.149524] CPU: 0 PID: 1 Comm: init Not tainted 6.6.86 #0
[ 3.155093] $ 0 : 00000000 10008400 fffd4000 00000001
[ 3.160444] $ 4 : 810a0000 fffd4000 810a0f00 81827480
[ 3.165788] $ 8 : 8087089c 7c3f0000 00000009 00000020
[ 3.171133] $12 : 00000001 00003185 00000000 ffffff00
[ 3.176477] $16 : 810a0000 8087089c 80871880 81973f78
[ 3.181821] $20 : 818fd1e0 00000a55 81973f78 77e1c000
[ 3.187165] $24 : 00000000 ffffffff
[ 3.192501] $28 : 81828000 81829e00 80871880 800106ec
[ 3.197845] Hi : 0000205e
[ 3.200758] Lo : 0000102f
[ 3.203670] epc : 80012fc0 0x80012fc0
[ 3.207563] ra : 800106ec 0x800106ec
[ 3.211455] Status: 10008403 KERNEL EXL IE
[ 3.215723] Cause : 0080001c (ExcCode 07)
[ 3.219782] PrId : 0002901a (Broadcom BMIPS3300)
[ 3.224540] Modules linked in:
[ 3.227637] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)
[ 3.235387] Stack : 818fd1e0 00000a55 80801000 00000000 81829e88 801679ec 81824fe8 81976960
[ 3.243940] 8073e270 82017f34 818fd1e0 00020000 8200b980 00000000 00000000 00000000
[ 3.252485] 00000255 81973f78 00000040 818fd1e0 81973f78 00000255 80801000 00000000
[ 3.261031] 00000000 80169d7c 10008400 800517f0 818fd1e4 77e1b000 77e1dfff 818d340c
[ 3.269585] 00000000 ffffffff 81973f78 00100cca 000000c0 77e1c000 77e1c2a0 00000a55
[ 3.278131] ...
[ 3.280624] Call Trace:
[ 3.280642] [<801679ec>] 0x801679ec
[ 3.286663] [<80169d7c>] 0x80169d7c
[ 3.290202] [<800517f0>] 0x800517f0
[ 3.293764] [<8000fd78>] 0x8000fd78
[ 3.297305] [<800010f0>] 0x800010f0
[ 3.300854] [<80014da8>] 0x80014da8
[ 3.304432]
[ 3.305945] Code: cc9e0060 cc9e0070 cca40100 <8ca80000> 8ca90004 8caa0008 8cab000c cc9e0080 ac880000
[ 3.315934]
[ 3.317590] ---[ end trace 0000000000000000 ]---
[ 3.322338] Kernel panic - not syncing: Fatal exception
[ 3.327645] Rebooting in 1 seconds..
[ 4.330800] bcm47xx: Please stand by while rebooting the system...
I tried to install version 23.05.5, disable Wi-Fi then upgrade keeping the settings... I got the same endless loop 
try https://firmware-selector.openwrt.org/?version=24.10.1&target=bcm47xx%2Fgeneric&id=linksys_wrt610n-v1, click the tiny arrow, and put a hyphen in front of kmod-b43 (-kmod-b43), request a new image, and try flashing it.
it'll make you loose all wifi functionality (if you ever had any) though.
I'm not using Wi-Fi feature of this device so no big deal 
Unfortunately the custom image has the same issue 
The kmod-b43 is part of Open WRT 23.05.5 too, I am not sure it is the culprit
The log a couple of lines before where you started posting might say which module caused the panic.
Here is the full log of the boot process:
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Wed Jun 25 19:11:21 CST 2008 (ljh@team2-complier)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing PCI. [normal]
PCI bus 0 slot 0/0: vendor 0x14e4 product 0x0800 (flash memory, rev 0x02)
PCI bus 0 slot 1/0: vendor 0x14e4 product 0x471f (ethernet network, rev 0x02)
PCI bus 0 slot 2/0: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x10 , rev 0x02)
PCI bus 0 slot 2/1: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x20 , rev 0x02)
PCI bus 0 slot 3/0: vendor 0x14e4 product 0x471b (USB serial bus, rev 0x02)
PCI bus 0 slot 4/0: vendor 0x14e4 product 0x0804 (PCI bridge, rev 0x02)
PCI bus 0 slot 5/0: vendor 0x14e4 product 0x0816 (MIPS processor, rev 0x02)
PCI bus 0 slot 6/0: vendor 0x14e4 product 0x471d (IDE mass storage, rev 0x02)
PCI bus 0 slot 7/0: vendor 0x14e4 product 0x4718 (network/computing crypto, rev 0x02)
PCI bus 0 slot 8/0: vendor 0x14e4 product 0x080f (RAM memory, rev 0x02)
PCI bus 0 slot 9/0: vendor 0x14e4 product 0x471e (class 0xfe, subclass 0x00, rev 0x02)
Initializing Devices.
No DPN
This is a Parallel Flash
Boot partition size = 262144(0x40000)
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 0004001B (28)
os #02 0004001C -> 007F7FFF (8093668)
nvram #03 007F8000 -> 007FFFFF (32768)
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 007F7FFF (8093696)
nvram #02 007F8000 -> 007FFFFF (32768)
PCI bus 0 slot 1/0: pci_map_mem: attempt to map 64-bit region tag=0x800 @ addr=1 8010004
PCI bus 0 slot 1/0: pci_map_mem: addr=0x18010004 pa=0x18010000
ge0: BCM5750 Ethernet at 0x18010000
CPU type 0x2901A: 300MHz
Total memory: 65536 KBytes
Total memory used by CFE: 0x80700000 - 0x807A60E0 (680160)
Initialized Data: 0x8073A2E0 - 0x8073E570 (17040)
BSS Area: 0x8073E570 - 0x807400E0 (7024)
Local Heap: 0x807400E0 - 0x807A40E0 (409600)
Stack Area: 0x807A40E0 - 0x807A60E0 (8192)
Text (code) segment: 0x80700000 - 0x8073A2E0 (238304)
Boot area (physical): 0x007A7000 - 0x007E7000
Relocation Factor: I:00000000 - D:00000000
Boot version: v4.2
The boot is CFE
mac_init(): Find mac [00:22:6B:7A:64:B8] in location 1
Nothing...
country_init(): Find country code in location 0
The country is same
CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
eth0: Link speed: 1000BaseT FDX
Device eth0: hwaddr 00-22-6B-7A-64-B8, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
CMD: [go;]
Check CRC of image1
Len: 0x6B1000 (7016448) (0xBC040000)
Offset0: 0x1C (28) (0xBC04001C)
Offset1: 0x928 (2344) (0xBC040928)
Offset2: 0x268800 (2525184) (0xBC2A8800)
Header CRC: 0xCD59818D
Calculate CRC: 0xCD59818D
Image 1 is OK
Try to load image 1.
CMD: [load -raw -addr=0x807a60e0 -max=0x3a0000 :]
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
CMD: [boot -raw -z -addr=0x80001000 -max=0x3a0000 flash0.os:]
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3808 bytes read
Entry at 0x80001000
Closing network.
eth0: cannot clear 1400/00000002
Starting program at 0x80001000
[ 0.000000] Linux version 6.6.86 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28597-0425664679) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Sun Apr 13 16:38:32 2025
[ 0.000000] CPU0 revision is: 0002901a (Broadcom BMIPS3300)
[ 0.000000] bcm47xx: Using ssb bus
[ 0.000000] ssb: Found chip with id 0x4785, rev 0x02 and package 0x0C
[ 0.000000] ssb: Sonics Silicon Backplane found at address 0x18000000
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
[ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Kernel command line: noinitrd console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 56376K/65536K available (6579K kernel code, 607K rwdata, 780K rodata, 216K init, 304K bss, 9160K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] MIPS: machine is Linksys WRT610N V1
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 12741736309 ns
[ 0.000004] sched_clock: 32 bits at 150MHz, resolution 6ns, wraps every 14316557820ns
[ 0.000303] Calibrating delay loop... 299.82 BogoMIPS (lpj=1499136)
[ 0.070053] pid_max: default: 32768 minimum: 301
[ 0.105050] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.105152] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.135979] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[ 0.143964] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.144049] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.161584] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.163027] thermal_sys: Registered thermal governor 'step_wise'
[ 0.190614] clocksource: Switched to clocksource MIPS
[ 0.526413] PCI host bridge to bus 0000:00
[ 0.526463] pci_bus 0000:00: root bus resource [mem 0x40000000-0x7fffffff]
[ 0.526516] pci_bus 0000:00: root bus resource [io 0x0100-0x07ff]
[ 0.526553] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.526673] pci 0000:00:00.0: PCI: Fixing up bridge 0000:00:00.0
[ 0.526720] pci 0000:00:00.0: PCI: Fixing up device 0000:00:00.0
[ 0.526760] pci 0000:00:00.0: PCI: Fixing latency timer of device 0000:00:00.0 to 168
[ 0.526799] pci 0000:00:00.0: [14e4:4785] type 00 class 0x060000
[ 0.526868] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00001fff]
[ 0.526918] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x07ffffff pref]
[ 0.527668] pci 0000:00:01.0: [14e4:4322] type 00 class 0x028000
[ 0.527764] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x00003fff]
[ 0.528621] pci 0000:00:02.0: [14e4:4322] type 00 class 0x028000
[ 0.528718] pci 0000:00:02.0: reg 0x10: [mem 0x00000000-0x00003fff]
[ 0.529484] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[ 0.529580] pci 0000:00:01.0: BAR 0: assigned [mem 0x40000000-0x40003fff]
[ 0.529638] pci 0000:00:02.0: BAR 0: assigned [mem 0x40004000-0x40007fff]
[ 0.530539] gpio gpiochip0: Static allocation of GPIO base is deprecated, use dynamic allocation.
[ 0.533046] b43-pci-bridge 0000:00:01.0: enabling device (0000 -> 0002)
[ 0.533109] b43-pci-bridge 0000:00:01.0: PCI: Fixing up device 0000:00:01.0
[ 0.590831] ssb: Found chip with id 0x4322, rev 0x01 and package 0x09
[ 0.679248] alpha2 is too long US2
[ 0.796895] can not parse nvram name pci/1/1/rxpo2g(null) with value 0xff got -34
[ 0.962270] b43-pci-bridge 0000:00:01.0: Sonics Silicon Backplane found on PCI device 0000:00:01.0
[ 0.962514] b43-pci-bridge 0000:00:02.0: enabling device (0000 -> 0002)
[ 0.962564] b43-pci-bridge 0000:00:02.0: PCI: Fixing up device 0000:00:02.0
[ 1.020804] ssb: Found chip with id 0x4322, rev 0x01 and package 0x09
[ 1.206969] can not parse nvram name pci/1/2/rxpo2g(null) with value 0xff got -34
[ 1.207184] can not parse nvram name pci/1/2/rxpo5g(null) with value 0xff got -34
[ 1.352154] b43-pci-bridge 0000:00:02.0: Sonics Silicon Backplane found on PCI device 0000:00:02.0
[ 1.353013] PCI host bridge to bus 0000:01
[ 1.353059] pci_bus 0000:01: root bus resource [mem 0x18010000-0x1801ffff]
[ 1.353111] pci_bus 0000:01: root bus resource [io 0x0800-0x08ff]
[ 1.353148] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff]
[ 1.353267] pci 0000:01:00.0: [14e4:1676] type 00 class 0x020000
[ 1.353337] pci 0000:01:00.0: reg 0x10: [mem 0x18010000-0x1801ffff 64bit]
[ 1.353483] pci 0000:01:00.0: PME# supported from D3hot D3cold
[ 1.354124] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 1.354213] pci 0000:01:00.0: BAR 0: assigned [mem 0x18010000-0x1801ffff 64bit]
[ 1.359367] NET: Registered PF_INET protocol family
[ 1.360199] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 1.365161] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 1.365321] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 1.365378] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 1.365479] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 1.365645] TCP: Hash tables configured (established 1024 bind 1024)
[ 1.368242] MPTCP token hash table entries: 512 (order: 0, 6144 bytes, linear)
[ 1.369086] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 1.369215] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 1.372312] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 1.372622] PCI: CLS 0 bytes, default 16
[ 1.393710] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[ 1.399414] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.399463] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 1.425950] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 1.428539] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 1.443757] printk: console [ttyS0] disabled
[ 1.465438] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 4687500) is a U6_16550A
[ 1.465589] printk: console [ttyS0] enabled
[ 2.120339] serial8250.0: ttyS1 at MMIO 0xb8000400 (irq = 2, base_baud = 4687500) is a U6_16550A
[ 2.132385] physmap-flash physmap-flash.0: physmap platform flash device: [mem 0x1c000000-0x1e000000]
[ 2.141973] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x00007f Chip ID 0x0022cb
[ 2.152613] Amd/Fujitsu Extended Query Table at 0x0040
[ 2.157843] Amd/Fujitsu Extended Query version 1.1.
[ 2.163017] number of CFI chips: 1
[ 2.172716] 3 bcm47xxpart partitions found on MTD device physmap-flash.0
[ 2.179536] Creating 3 MTD partitions on "physmap-flash.0":
[ 2.185254] 0x000000000000-0x000000040000 : "boot"
[ 2.286019] 0x000000040000-0x0000007f0000 : "firmware"
[ 2.297035] failed to parse "brcm,trx-magic" DT attribute, using default: -89
[ 2.304437] 3 trx partitions found on MTD device firmware
[ 2.309920] Creating 3 MTD partitions on "firmware":
[ 2.315013] 0x00000000001c-0x000000000928 : "loader"
[ 2.320058] mtd: partition "loader" doesn't start on an erase/write block boundary -- force read-only
[ 2.336624] 0x000000000928-0x000000268800 : "linux"
[ 2.341728] mtd: partition "linux" doesn't start on an erase/write block boundary -- force read-only
[ 2.358691] 0x000000268800-0x0000007b0000 : "rootfs"
[ 2.363886] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 2.379136] mtd: setting mtd4 (rootfs) as root device
[ 2.384441] 1 squashfs-split partitions found on MTD device rootfs
[ 2.390779] 0x000000670000-0x0000007b0000 : "rootfs_data"
[ 2.403347] 0x0000007f0000-0x000000800000 : "nvram"
[ 2.429587] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds, Software Timer)
[ 2.439246] GPIO_WDT: failed to register misc device
[ 2.450483] NET: Registered PF_INET6 protocol family
[ 2.502318] Segment Routing with IPv6
[ 2.506355] In-situ OAM (IOAM) with IPv6
[ 2.510798] NET: Registered PF_PACKET protocol family
[ 2.516042] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 2.529989] 8021q: 802.1Q VLAN Support v1.8
[ 2.666521] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[ 2.676475] Freeing unused kernel image (initmem) memory: 216K
[ 2.682520] This architecture does not have kernel memory protection.
[ 2.689068] Run /sbin/init as init process
[ 3.149174] Data bus error, epc == 80012fc0, ra == 800106ec
[ 3.154884] Oops[#1]:
[ 3.157195] CPU: 0 PID: 1 Comm: init Not tainted 6.6.86 #0
[ 3.162763] $ 0 : 00000000 10008400 fffd0000 00000001
[ 3.168115] $ 4 : 810a0000 fffd0000 810a0f00 81826f40
[ 3.173459] $ 8 : 8087089c 7c3f0000 00000009 00000020
[ 3.178804] $12 : 00000001 00003185 00000000 ffffff00
[ 3.184148] $16 : 810a0000 8087089c 80871880 81973d38
[ 3.189492] $20 : 818fdd20 00000a55 81973d38 77ed8000
[ 3.194836] $24 : 00000000 ffffffff
[ 3.200172] $28 : 81828000 81829e00 80871880 800106ec
[ 3.205516] Hi : 0000205e
[ 3.208428] Lo : 0000102f
[ 3.211341] epc : 80012fc0 0x80012fc0
[ 3.215234] ra : 800106ec 0x800106ec
[ 3.219126] Status: 10008403 KERNEL EXL IE
[ 3.223395] Cause : 0080001c (ExcCode 07)
[ 3.227452] PrId : 0002901a (Broadcom BMIPS3300)
[ 3.232211] Modules linked in:
[ 3.235307] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)
[ 3.243057] Stack : 818fdd20 00000a55 80801000 00000000 81829e88 801679ec 555e0034 819768c0
[ 3.251611] 7fe41e7e 820179f4 818fdd20 00020000 8200bbe0 00000000 00000000 00000000
[ 3.260155] 00000255 81973d38 00000040 818fdd20 81973d38 00000255 80801000 00000000
[ 3.268701] 00000000 80169d7c 00000006 00000000 818fdd24 77ed7000 77ed9fff 818d3d0c
[ 3.277247] 00000000 ffffffff 81973d38 00100cca 000000c0 77ed8000 77ed82a0 00000a55
[ 3.285793] ...
[ 3.288285] Call Trace:
[ 3.288304] [<801679ec>] 0x801679ec
[ 3.294325] [<80169d7c>] 0x80169d7c
[ 3.297884] [<8000fd78>] 0x8000fd78
[ 3.301424] [<800010f0>] 0x800010f0
[ 3.304968] [<80236a04>] 0x80236a04
[ 3.308515] [<80014da8>] 0x80014da8
[ 3.312094]
[ 3.313607] Code: cc9e0060 cc9e0070 cca40100 <8ca80000> 8ca90004 8caa0008 8cab000c cc9e0080 ac880000
[ 3.323596]
[ 3.325250] ---[ end trace 0000000000000000 ]---
[ 3.329946] Kernel panic - not syncing: Fatal exception
[ 3.335236] Rebooting in 1 seconds..
[ 4.338382] bcm47xx: Please stand by while rebooting the system...
Interesting, I guess the docs are way out of date on that router.
I've had good success with DD-WRT on Broadcom gear.
DD-WRT had an NDA with BCM, and were allowed to use and distribute their closed source drivers and BLOBs.
I also have good success with my Broadcom gear it was even ported to K4.4 which is still supported as SLTS release, my old R7000 can do gigabit LAN<>WAN with ctf hardware offload
It seems to be /sbin/init
They still have it. Broadcom elected to NOT release an Open Source toolkit for wifi6. If they eventually do then the DD-WRT NDA will allow DD-WRT to use it. And it does still allow them to release new versions for older wifi5 gear.
I read somewhere it had expired/got dropped, but that info obviously didn't come from any official source ...
Since they are still releasing firmware for BCM devices wifi5 and below, it can't have expired or been dropped. The main developer also has mentioned a few times that he got help from Broadcom in porting K4.4 to BCM devices.
It would not be impossible to create an alternative firmware for Broadcom wifi6 devices but it would have to be a complete greenfield development from scratch using Broadcom's GPL-required to be released binary blob drivers because apparently, they also changed the toolchain from ones used by everyone else to something new. But, it would be like Merlin in that it would deviate very little from the vendor-released firmware and some of the router vendors may have also disabled the ability in their bootloaders to bypass the signing checks so that the bootloader can be overwritten by a patched one that disables signing.
This is company culture driven for Broadcom. In recent years Broadcom has taken a very exploitive view of their non-core customers - they buy product lines used by Fortune 500 which would be hard to switch from then jack prices way up, then milk them. They did this with their Symantec purchase and they are doing it with VMWare. I don't know exactly what they got from those purchases but I'm pretty sure it was Intellectual Property, something related to the commodity chipmaking they are specialists at. The antivirus and virtualization products of those companies came along for the ride and were and are being milked.
All it would take is a single word from the Broadcom CEO Tan Hock Eng, and their developers would release an open source toolkit. It would not compromise intellectual property in any way or trade secrets. But Tan is one of the "golden boys" of High Tech, he's been running Broadcom/Avago for 20 years and his MO is to buy chipmaking companies and sell off and milk everything out of them other than what directly supports chipmaking. He understands that the majority of chips sold are commodity items and the way to make money in the chip market is to execute on making a product customers want to buy then make zillions of them and use economies of scale to minimize costs. His customers are companies like Belkin, Netgear, TP-Link, etc. He's like the big giant dairy that makes most of the milk in the supermarket that the majority of people buy for their kids to pour on their breakfast cereal and he's well aware that the only reason people buy his stuff is because it's cheap.
Because stuff like a FOSS development kit has marginal returns for Broadcom, Tan isn't going to put money into it nor will his people. If a large customer of theirs like for example Netgear were to demand it - they would do it immediately. But, when their customers like Netgear want to build product that people running OpenWRT or DD-WRT want to buy to repurpose - they just use MediaTek or Qualcomm chips. So Broadcom has no incentive to do anything. In fact, they WANT companies like MediaTek and Qualcomm to have a minority market share to immunize them from anti-trust criticism. The reality is that Broadcom has grown just about as large as it can grow in the chip market - a few years ago they tried buying Qualcomm and the federal government blocked the deal over anti-trust concerns.
MediaTek and Qualcomm are well aware many times they get selected precisely because they are NOT Broadcom and ARE friendly to FOSS.
I DON'T see the situation changing for another decade. Tan is older but he still has 5-10 years left running the company before he ages out of it and he will NOT retire before then for sure. He's good at making money and good at using Broadcom to make money and really doesn't give a rat's ass about what anyone other than his customers think including his employees. He's too old to take risks and try growing Broadcom beyond what it is now and it's big enough now to make plenty of money that will keep it's board happy, and allow it to periodically acquire other chipmakers who have promising tech and stumble.