Netgear DM200 bridge on AT&T U-verse

I'm attempting to follow the instructions on the this wiki page describing how to replace an AT&T Arris BGW210-700 modem with a Netgear DM200 running OpenWrt:

https://wiki2.andrewpeng.net/uverse_hacking

I've gotten to the last step with a DM200 successfully upgraded to the latest version of OpenWrt (22.03.5), but am unable to use the dsl0 interface.

Relevant logs:

https://pastebin.com/raw/AEFQt4xy

root@OpenWrt:/# ip l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST> mtu 1508 qdisc fq_codel state DOWN qlen 1000
    link/ether ETH0MACADDR brd ff:ff:ff:ff:ff:ff
3: lan@eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP,M-DOWN> mtu 1500 qdisc noqueue master br-lan state LOWERLAYERDOWN qlen 1000
    link/ether LANMACADDR brd ff:ff:ff:ff:ff:ff
5: br-lan: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN qlen 1000
    link/ether LANMACADDR brd ff:ff:ff:ff:ff:ff
root@OpenWrt:/# /etc/init.d/dsl_control dslstat
{
	"api_version": "4.17.18.6",
	"firmware_version": "5.7.11.5.0.7",
	"chipset": "Lantiq-VRX200",
	"driver_version": "1.5.17.6",
	"state": "Handshake",
	"state_num": 4,
	"up": false,
	"uptime": 0,
	"atu_c": {
		
	},
	"power_state": "L3 - No power",
	"power_state_num": 3,
	"upstream": {
		
	},
	"downstream": {
		
	},
	"errors": {
		"near": {
			"es": 0,
			"ses": 0,
			"loss": 0,
			"uas": 95,
			"lofs": 0,
			"fecs": 0,
			"hec": 0,
			"ibe": 0,
			"crc_p": 0,
			"crcp_p": 0,
			"cv_p": 0,
			"cvp_p": 0
		},
		"far": {
			"es": 0,
			"ses": 0,
			"loss": 0,
			"uas": 92,
			"lofs": 0,
			"fecs": 0,
			"hec": 0,
			"ibe": 0,
			"crc_p": 0,
			"crcp_p": 0,
			"cv_p": 0,
			"cvp_p": 0
		}
	}
}

/etc/config/network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fda7:b97b:37b2::/48'

config atm-bridge 'atm'
	option vpi '1'
	option vci '32'
	option encaps 'llc'
	option payload 'bridged'
	option nameprefix 'dsl'

config dsl 'dsl'
	option annex 'a'
	option line_mode 'vdsl'
	option ds_snr_offset '0'
	option firmware '/tmp/dslfirmware/dsl_vr9_firmware_xdsl-05.07.0B.bin'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan'

config device
	option name 'lan'
	option macaddr 'LANMACADDR'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'dsl0'
	option macaddr 'WANMACADDR'

config interface 'dsl0'
	option device 'dsl0'
	option proto 'none'

config interface 'br0'
	option device 'dsl0 eth0'
	option proto 'none'
	option type 'bridge'

Also tried upgrading to the latest firmware image for the DSL chip (7.B.5 extracted from V1.0.0.66), per instructions here, but it didn't fix the issue. Note that it has to be loaded into memory after launch since there isn't enough disk space on device:

ssh root@192.168.1.1 'mkdir /tmp/dslfirmware/' && scp dsl_vr9_firmware_xdsl-05.07.0B.bin root@192.168.1.1:/tmp/dslfirmware/

In the logs there is a firmware not found error before this is applied followed by service network restart && service dsl_control restart.

Any ideas on next steps? I have the certificates extracted, but this is failing before that point, so I think it's due to the dsl config. DSL_INTERFACE_STATUS only reaches HANDSHAKE and READY but needs to be UP for wpa_supplicant to start (see 99_dsl_eapol.sh).

Unfortunately, I can't find an example working config anywhere online, including the above wiki page. Not sure how else to determine these values. Should I extract a config file from the ISP modem, or sniff the traffic from its DSL line somehow?