OpenWRT One fails to boot, giving error 'BL2: Failed to load image id 3 (-22)'

Installing and Using OpenWrt
1

I have an OpenWRT One and it has been running fine for months. Then a couple of days ago it failed to reboot. It was giving the error 'BL2: Failed to load image id 5 (-2)'.

So I have been trying to re-flash it. I won't bother you all with the failures (I've gone through several USB sticks to find one that works, figured out how to run a TFTP server, run mtk_uartboot and learned a bunch in the process). I believe I have flashed 25.12.4 to both the NOR and NAND storage, and I've done multiple resets so there's no data on the device to worry about.

But it still fails to boot. This time the error is similar but slightly different:

ERROR:   io_dev_init failed for FIP image id 0 (-22)
ERROR:   Image id 3 open failed with -22
ERROR:   BL2: Failed to load image id 3 (-22)

The full console when booting NAND is:

NOTICE:  BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL2: Built : 22:42:09, May 13 2026
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  UBI: scanning [0x100000 - 0x10000000] ...
NOTICE:  UBI: EOF marker found in block 173
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   io_dev_init failed for FIP image id 0 (-22)
ERROR:   Image id 3 open failed with -22
ERROR:   BL2: Failed to load image id 3 (-22)

I don't know what the error means or how to fix it.

One thing that may be important: bad blocks when flashing. Here's the full log of flashing NAND from USB:

on
starting USB...
xhci-mtk xhci@11200000: hcd: 0x0000000011200000, ippc: 0x0000000011203e00
xhci-mtk xhci@11200000: ports disabled mask: u3p-0x1, u2p-0x0
xhci-mtk xhci@11200000: u2p:1, u3p:1
Register 200010f NbrPorts 2
Starting the controller
USB XHCI 1.10
Bus xhci@11200000: 2 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
238440 bytes read in 16 ms (14.2 MiB/s)
Erasing 0x00000000 ... 0x000fffff (8 eraseblock(s))
Writing 262144 byte(s) (128 page(s)) at offset 0x00000000
Writing 262144 byte(s) (128 page(s)) at offset 0x00040000
Writing 262144 byte(s) (128 page(s)) at offset 0x00080000
23330816 bytes read in 912 ms (24.4 MiB/s)
Erasing 0x00000000 ... 0x0fefffff (2040 eraseblock(s))
Skipping bad block at 0x04340000
Skipping bad block at 0x04360000
Skipping bad block at 0x0c440000
Skipping bad block at 0x0ddc0000
Skipping bad block at 0x0e5e0000
Writing 23330816 byte(s) (11392 page(s)) at offset 0x00000000
done

I have tried erasing the NAND storage using dontskipbad, and here is the result:

OpenWrt One> mtd erase.dontskipbad spi-nand0
Erasing 0x00000000 ... 0x0fffffff (2048 eraseblock(s))
nand: attempt to erase a bad/reserved block @4440000
nand: attempt to erase a bad/reserved block @4460000
nand: attempt to erase a bad/reserved block @c540000
nand: attempt to erase a bad/reserved block @dec0000
nand: attempt to erase a bad/reserved block @e6e0000

So, while I've learned some things I don't think I really understand the problem or how to fix it. Are the bad blocks interfering with the flash and boot process? Is the hardware failing? Is there more diagnosis I can do? Or something else to try? Have I done something wrong with the flashing somehow?

2

FWIW I just tried flashing 25.12.2 instead of 25.12.4. Seems to have the same problem.

Flashing output:

on
starting USB...
xhci-mtk xhci@11200000: hcd: 0x0000000011200000, ippc: 0x0000000011203e00
xhci-mtk xhci@11200000: ports disabled mask: u3p-0x1, u2p-0x0
xhci-mtk xhci@11200000: u2p:1, u3p:1
Register 200010f NbrPorts 2
Starting the controller
USB XHCI 1.10
Bus xhci@11200000: 2 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
238440 bytes read in 17 ms (13.4 MiB/s)
Erasing 0x00000000 ... 0x000fffff (8 eraseblock(s))
Writing 262144 byte(s) (128 page(s)) at offset 0x00000000
Writing 262144 byte(s) (128 page(s)) at offset 0x00040000
Writing 262144 byte(s) (128 page(s)) at offset 0x00080000
23330816 bytes read in 914 ms (24.3 MiB/s)
Erasing 0x00000000 ... 0x0fefffff (2040 eraseblock(s))
Skipping bad block at 0x04340000
Skipping bad block at 0x04360000
Skipping bad block at 0x0c440000
Skipping bad block at 0x0ddc0000
Skipping bad block at 0x0e5e0000
Writing 23330816 byte(s) (11392 page(s)) at offset 0x00000000
done

Booting NAND:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024C [010F]
Jump to BL

NOTICE:  BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL2: Built : 20:09:53, Mar 25 2026
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  UBI: scanning [0x100000 - 0x10000000] ...
NOTICE:  UBI: EOF marker found in block 173
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   io_dev_init failed for FIP image id 0 (-22)
ERROR:   Image id 3 open failed with -22
ERROR:   BL2: Failed to load image id 3 (-22)

I'm out of ideas. Anyone have any suggestions? Thanks.

3

That error indicates that BL2 (the bootloader) cannot locate or read the FIP (Firmware Image Package) so the next boot chain stage fails. This isn't your flashing of the openwrt-mediatek-filogic-openwrt_one-snand-preloader.bin or openwrt-mediatek-filogic-openwrt_one-factory.ubi causing the fault.

A couple of questions: Did you set the NAND/NOR switch to NOR before powering up the OO?, can you boot into NAND initramfs?

4

Many thanks for that. It's good to know that it wasn't flashing those files that caused a problem.

I'm ready for any questions that'll help solve this problem!

I've tried both NAND and NOR boots.
NOR: boots fine into the recovery menu etc., as expected.
NAND: fails with the above error log, ending with BL2: Failed to load image id 3 (-22)

I can boot with initramfs using TFTP. I think it was NAND, but I will double-check that now.

5

You shouldn’t need TFTP to boot into initramfs. Power down, hold back panel reset and power up. Watch the leds cycle. Ensure NAND selected.

6

Thanks. I've used tftp and mtk_uartboot and I'm now very confused about what does what. Sorry.

OK, NAND selected, serial console USB-C connected, RESET button on the back held down, power plug plugged in, and here's the console output:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024C [010F]
Jump to BL

NOTICE:  BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL2: Built : 20:09:53, Mar 25 2026
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  UBI: scanning [0x100000 - 0x10000000] ...
NOTICE:  UBI: EOF marker found in block 173
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   io_dev_init failed for FIP image id 0 (-22)
ERROR:   Image id 3 open failed with -22
ERROR:   BL2: Failed to load image id 3 (-22)

It looks identical to the regular NAND boot to me.

7

Are you following the wiki? https://openwrt.org/toh/openwrt/one?do=#recovery

Where does this come into play?

8

Yes transfer the initramfs image (with NAND support) to RAM using TFTP then boot it in RAM. That does not depend on anything in flash beyond the bootloader. (Since this copy of the OS is only in RAM it will not survive turning the power off.) Once OpenWrt is running you have various tools to muck around in the NAND, or possibly simply running the sysupgrade script with a sysupgrade image will make a working install.

9

Yes. I started with that a few days ago, and have tried (and failed) at other approaches since.

From that Recover link, I've tried:

  • Boot into NOR/full recovery mode: Flash NAND from USB which gave the 'Flashing output' in my first message.
  • Boot into UART recovery: Flash NOR from TFTP which (I believe successfully) updated the NOR storage to 25.12.4. This is the step that used mtk_uartboot and tftp that I was getting confused about.

Desperation, after reading this BananaPi forum link about bad blocks in OpenWRT One.

10

Sound familiar OpenWRT One permanently bricked through OpenWRT 25.12 upgrade

As @mk24 indicates, if you can’t initiate initramfs via the reset button in NAND boot, by all means try it via TFTP.

11

With NAND selected, running the command:

~/Downloads/mtk_uartboot --aarch64 --brom-load-baudrate 115200 --bl2-load-baudrate 115200 -s /dev/tty.usbmodem00001 -p ~/Downloads/25.12.4/mt7981-ram-ddr4-bl2.bin -f ~/Downloads/25.12.4/openwrt-mediatek-filogic-openwrt_one-snand-bl31-uboot.fip && screen /dev/tty.usbmodem00001 115200

I was able to boot from initramfs:

mtk_uartboot - 0.1.1
Using serial port: /dev/tty.usbmodem00001
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 115200
sending payload to 0x201000...
Checksum: 0xea1b
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7981-ram-ddr4)
NOTICE:  BL2: Built : 22:42:09, May 13 2026
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 115200

Worryingly, sometimes when I tried I would get errors that said:

Incorrect checksum: 0x7368 != 0x7378

(Sometimes multiple times per boot, but always with those figures.)

When I got it to boot with no errors, I got this menu:

        ( ( ( OpenWrt ) ) )  [SPI-NAND]       U-Boot 2025.10-OpenWrt-r32933-4ccb782af7 (May 13 2026 - 22:42:09 +0000)

      1. Run default boot command.
      2. Boot system via TFTP.
      3. Boot production system from NAND.
      4. Boot recovery system from NAND.
      5. Load production system via TFTP then write to NAND.
      6. Load recovery system via TFTP then write to NAND.
      7. Load BL31+U-Boot FIP via TFTP then write to NAND.
      8. Load BL2 preloader via TFTP then write to NAND.
      9. Reboot.
      a. Reset all settings to factory defaults.
      0. Exit


  Press UP/DOWN to move, ENTER to select, ESC to quit

Is U-Boot 2025.10-OpenWrt-r32933-4ccb782af7 (May 13 2026 - 22:42:09 +0000) correct? All the files should be from the 25.12.4 release.

I figured the problem was with BL2, so I tried option 8. Load BL2 preloader via TFTP then write to NAND.:

Using ethernet@15100000 device
TFTP from server 192.168.11.23; our IP address is 192.168.11.11
Filename 'openwrt-mediatek-filogic-openwrt_one-snand-preloader.bin'.
Load address: 0x46000000
Loading: #################
         1.8 MiB/s
done
Bytes transferred = 238440 (3a368 hex)
Erasing 0x00000000 ... 0x000fffff (8 eraseblock(s))
Unknown command 'offset' - try 'help'
Unknown command '0x0' - try 'help'
Writing 1048576 byte(s) (512 page(s)) at offset 0x00040000
Failure while writing at offset 0x100000
Write on bl2 failed with error -22
Press ENTER to return to menu

I don't know why it's giving Unknown command errors.

I also tried 7. Load BL31+U-Boot FIP via TFTP then write to NAND.:

Using ethernet@15100000 device
TFTP from server 192.168.11.23; our IP address is 192.168.11.11
Filename 'openwrt-mediatek-filogic-openwrt_one-snand-bl31-uboot.fip'.
Load address: 0x46000000
Loading: #################################################################
         ####
         3.3 MiB/s
done
Bytes transferred = 998796 (f3d8c hex)
Remove UBI volume fip (id 2)
Creating static volume fip of size 998796
Please see usage
Press ENTER to return to menu

I don't know why it's giving the Please see usage error.

Does this make the problem clearer to anyone? Which of those menu options should I focus one?

Many thanks!

12

Yeah. FWIW I've just checked and my NAND chip is Winband 25NO2KVZEIR which seems to be the right one (according to that message), and the board didn't show any signs of the poor soldering visible in those photos.

Thanks for all your help.

Sometimes Bad Things happen, so at this stage I think I'm just going to write it off and buy a new one. Unless anyone out there has any other ideas to try?

13

I still think this is recoverable. Just gut instinct and I am a stubborn sob, but it is still responding on both nand and nor flashes albeit w/issues.

From what I see from your "7. Load BL31+U-Boot FIP via TFTP then write to NAND." The TFTP transfer itself is good, but we are right back to the original UBI Volume Creation Failed. To venture a guess, I would say maybe the UBI subsystem wasn't properly attached to the NAND device? But now I am out of my depth.

You could maybe try running a sysupgrade instance from the initramfs as a last ditch attempt.

FWIW, this thread ended up being the wiki Recovery method. Might be worth a read just to see if anything stands out: Cautionary tale - bricked OpenWRT One on first day

Let's see if a ping @daniel might get him to take a look into this.

14

I'm happy to try! I'm just out of ideas.

OK. Some more logs for you. I thought I'd try option 5 ( Load production system via TFTP then write to NAND.) to perform the sysupgrade - I'm happy to try a different one if you let me know.

With the selector set to NAND,I ran the following command:

~/Downloads/mtk_uartboot --aarch64 --brom-load-baudrate 115200 --bl2-load-baudrate 115200 -s /dev/tty.usbmodem00001 -p ~/Downloads/25.12.4/mt7981-ram-ddr4-bl2.bin -f ~/Downloads/25.12.4/openwrt-mediatek-filogic-openwrt_one-snand-bl31-uboot.fip && screen /dev/tty.usbmodem00001 115200

Booting went OK. Choosing option 5 from the menu, I got the following:

Using ethernet@15100000 device
TFTP from server 192.168.11.23; our IP address is 192.168.11.11
Filename 'openwrt-mediatek-filogic-openwrt_one-squashfs-sysupgrade.itb'.
Load address: 0x46000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################################################
         3.6 MiB/s
done
Bytes transferred = 11272458 (ac010a hex)

## Checking Image at 46000000 ...
   FIT image found
   FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  ARM64 OpenWrt Linux-6.12.87
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x46001000
     Data Size:    5879616 Bytes = 5.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   f6d70fdc
     Hash algo:    sha1
     Hash value:   49ae1fbe859b20ddc41e876134b4597fe3d99b8c
    Image 1 (fdt-1)
     Description:  ARM64 OpenWrt openwrt_one device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4659d000
     Data Size:    29475 Bytes = 28.8 KiB
     Architecture: AArch64
     Load Address: 0x43f00000
     Hash algo:    crc32
     Hash value:   05804556
     Hash algo:    sha1
     Hash value:   5c16f002cc67f9845b874528d0c9c6c5e6117e65
    Image 2 (rootfs-1)
     Description:  ARM64 OpenWrt openwrt_one rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x465a5000
     Data Size:    5320704 Bytes = 5.1 MiB
     Hash algo:    crc32
     Hash value:   37ebf27e
     Hash algo:    sha1
     Hash value:   fcab4f415f07380e16d7835319bebbbe15b59cb2
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt openwrt_one
     Kernel:       kernel-1
     FDT:          fdt-1
     Loadables:    rootfs-1
## Checking hash(es) for FIT Image at 46000000 ...
   Hash(es) for Image 0 (kernel-1): crc32+ sha1+
   Hash(es) for Image 1 (fdt-1): crc32+ sha1+
   Hash(es) for Image 2 (rootfs-1): crc32+ sha1+
Remove UBI volume fit (id 4)
Creating dynamic volume fit of size 11272458
11272458 bytes written to volume fit
## Loading kernel (any) from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.87
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x46001000
     Data Size:    5879616 Bytes = 5.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   f6d70fdc
     Hash algo:    sha1
     Hash value:   49ae1fbe859b20ddc41e876134b4597fe3d99b8c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt (any) from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt openwrt_one device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4659d000
     Data Size:    29475 Bytes = 28.8 KiB
     Architecture: AArch64
     Load Address: 0x43f00000
     Hash algo:    crc32
     Hash value:   05804556
     Hash algo:    sha1
     Hash value:   5c16f002cc67f9845b874528d0c9c6c5e6117e65
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Loading fdt from 0x4659d000 to 0x43f00000
   Booting using the fdt blob at 0x43f00000
Working FDT set to 43f00000
## Loading loadables (any) from FIT Image at 46000000 ...
   Trying 'rootfs-1' loadables subimage
     Description:  ARM64 OpenWrt openwrt_one rootfs
     Type:         Filesystem Image
     Compression:  uncompressed
     Data Start:   0x465a5000
     Data Size:    5320704 Bytes = 5.1 MiB
     Hash algo:    crc32
     Hash value:   37ebf27e
     Hash algo:    sha1
     Hash value:   fcab4f415f07380e16d7835319bebbbe15b59cb2
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Uncompressing Kernel Image to 44000000
   Loading Device Tree to 000000007e7e9000, end 000000007e7f3322 ... OK
Working FDT set to 7e7e9000
"Synchronous Abort" handler, esr 0x8600000d, far 0x0
elr: ffffffffc1ee7000 lr : ffffffffc1ee7000 (reloc)
elr: 0000000000000000 lr : 0000000000000000
x0 : 0000000000000001 x1 : 000000007e7e9000
x2 : 000000007ffc32c2 x3 : 0000000000000022
x4 : 000000007f7fb5a8 x5 : 000000000000a323
x6 : 00000000000044e8 x7 : 000000007e7e9000
x8 : 00000000000044e4 x9 : 000000007f7fb4fc
x10: 0000000000000002 x11: 00000000000044a8
x12: 000000007f7fb5b8 x13: 000000007e7e9000
x14: 00000000fffffff4 x15: 0000000000000020
x16: 000000007ff6bf0c x17: 0000000000000001
x18: 000000007f7ffe00 x19: 000000007f7fb5e8
x20: 000000007e7e9000 x21: 00000000000044a8
x22: 000000007ffc32c2 x23: 0000000000000001
x24: 0000000046001000 x25: 0000000046000000
x26: 0000000046001000 x27: 0000000046000000
x28: 0000000046001000 x29: 0000000000000022

Code: "Synchronous Abort" handler, esr 0x96000004, far 0xfffffffffffffff0
elr: 0000000041e032f4 lr : 0000000041e032f4 (reloc)
elr: 000000007ff1c2f4 lr : 000000007ff1c2f4
x0 : 0000000000000006 x1 : 0000000000000000
x2 : 000000007ff6c450 x3 : 000000007f7faed0
x4 : 000000007f7faf10 x5 : 0000000000000032
x6 : 000000007f7fada8 x7 : 0000000000000001
x8 : 000000007f7fb400 x9 : 00000000ffffffe8
x10: 000000000000000d x11: 0000000000000006
x12: 000000007f7fb5b8 x13: 000000007e7e9000
x14: 00000000fffffffe x15: 0000000000000021
x16: 000000007ff6bf0c x17: 0000000000000001
x18: 000000007f7ffe00 x19: fffffffffffffffc
x20: 000000007ffcc599 x21: 000000007ffc164a
x22: 000000007ffc57df x23: 0000000000000000
x24: 0000000046001000 x25: 0000000046000000
x26: 0000000046001000 x27: 0000000046000000
x28: 0000000046001000 x29: 000000007f7fb400

Code: 92800073 b0000520 911aa400 94023c33 (b8737ae1)
Resetting CPU ...

resetting ...

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024C [010F]
Jump to BL

NOTICE:  BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7981-spim-nand-ubi-ddr4)
NOTICE:  BL2: Built : 22:42:09, May 13 2026
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 268435456
NOTICE:  UBI: scanning [0x100000 - 0x10000000] ...
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   io_dev_init failed for FIP image id 0 (-22)
ERROR:   Image id 3 open failed with -22
ERROR:   BL2: Failed to load image id 3 (-22)

I don't know what the "Synchronous Abort" handler means but it doesn't sound good!

With the selector set to NOR I ran the following command:

~/Downloads/mtk_uartboot --aarch64 --brom-load-baudrate 115200 --bl2-load-baudrate 115200 -s /dev/tty.usbmodem00001 -p ~/Downloads/25.12.4/mt7981-ram-ddr4-bl2.bin -f ~/Downloads/25.12.4/openwrt-mediatek-filogic-openwrt_one-nor-bl31-uboot.fip && screen /dev/tty.usbmodem00001 115200

It does not get as far as the boot menu. It says:

mtk_uartboot - 0.1.1
Using serial port: /dev/tty.usbmodem00001
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 115200
sending payload to 0x201000...
Checksum: 0xea1b
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.13.0(release):OpenWrt v2025.07.11~78a0dfd9-1 (mt7981-ram-ddr4)
NOTICE:  BL2: Built : 22:42:09, May 13 2026
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 115200


ERROR:   xz: xz_dec_run() failed (err = 7)
ERROR:   Failed to decompress image (err=-5)
ERROR:   BL2: Failure in post image load handling (-5)

Perhaps I got the mtk_uartboot command wrong?

Many thanks!