Got it working.
I patched scripts/gen_image_generic.sh like so:
diff --git a/scripts/gen_image_generic.sh b/scripts/gen_image_generic.sh
index 11e40f3886..f5a5a74d3a 100755
--- a/scripts/gen_image_generic.sh
+++ b/scripts/gen_image_generic.sh
@@ -28,6 +28,26 @@ KERNELSIZE="$2"
ROOTFSOFFSET="$(($3 / 512))"
ROOTFSSIZE="$(($4 / 512))"
+stringContain() { case $2 in *$1* ) return 0;; *) return 1;; esac ;}
+
+if stringContain 'efi' "$OUTPUT"; then
+ cat <<EOF >"${OPENWRT_OUTPUT_DIR}/efi-image.sizes"
+BLOCKSIZE=512
+KERNELOFFSET=${KERNELOFFSET}
+KERNELSIZE=${KERNELSIZE}
+ROOTFSOFFSET=${ROOTFSOFFSET}
+ROOTFSSIZE=$(du -b "${ROOTFSIMAGE}" | cut -f1)
+EOF
+else
+ cat <<EOF >"${OPENWRT_OUTPUT_DIR}/mbr-image.sizes"
+BLOCKSIZE=512
+KERNELOFFSET=${KERNELOFFSET}
+KERNELSIZE=${KERNELSIZE}
+ROOTFSOFFSET=${ROOTFSOFFSET}
+ROOTFSSIZE=$(du -b "${ROOTFSIMAGE}" | cut -f1)
+EOF
+fi
+
# Using mcopy -s ... is using READDIR(3) to iterate through the directory
# entries, hence they end up in the FAT filesystem in traversal order which
# breaks reproducibility.
Then after building the image, run:
gunzip -k openwrt-output/openwrt.img.gz -c | dd of=test.img bs=${BLOCKSIZE} count=$((ROOTFSOFFSET + (ROOTFSSIZE/BLOCKSIZE) + 1 ))
dd if=/dev/zero bs=512 count=40960 >>test.img