I'm trying to figure out the Wifi MAC address issue. In the script /etc/hotplug.d/firmware/11-ath11k-caldata I can see that MAC is retrieved from art partition.
caldata_extract "0:art" 0x1000 0x20000
If I look into ART for this specific device I see:
0000:1000 | 01 00 04 04 00 00 00 00 00 80 F7 82 18 04 00 03 | ..........÷.....
0000:1010 | 7F 12 34 56 00 03 7F 12 34 57 00 03 7F 12 34 58 | ..4V....4W....4X
0000:1020 | 00 03 7F 12 34 59 00 03 7F 12 34 5A 00 03 7F 12 | ....4Y....4Z....
0000:1030 | 34 5B | 4[
If I look at it the 1st three octets are 00:03:7F I get a typical Atheros MAC. While the following octets are 12 34 56-5B. They look strange (at least to me).
Every reboot the last 3 octets of the Wifi MAC are changing.
It looks like this (3 devices, 6 AP's)
phy1-ap0 00:03:7f:12:3d:87
phy0-ap0 00:03:7f:12:f9:a3
pyh2-ap0 00:03:7f:12:c1:ab
pyh2-ap1 02:03:7f:12:c1:ab permaddr 00:03:7f:12:c1:ab
pyh1-ap1 02:03:7f:12:3d:87 permaddr 00:03:7f:12:3d:87
pyh0-ap1 02:03:7f:12:f9:a3 permaddr 00:03:7f:12:f9:a3
I see the manufacturer part 00:03:7F and I understand the addition to 02 for ap1.
Basically we have 6 MAC addresses. While I guess that 3 are for wifi and at least one for bluetooth.
What did I try:
As we have an mmc device here I've tried to change to caldata_extract_mmc. It does not change anything. I've restricted the search range for MAC e. g. 0x100E-0x1031. No dice.
So my assumption:
- OpenWrt is looking into ART finds sth. is wrong and let run the last 3 octets through a meat grinder. Every reboot.
- The device MAC retrieved from ART is the wrong approach for this specific device.
If I compare it to AX3600 I can see that the 1st three octets are the same for wifi and eth devices.
For this device its different. I have bc:cf:4f for eth devices and 00:03:7f for wifi devices. I can see those values in ART also.
Something is wrong here and I have the feeling that OpenWrt installation has sth. to do with altering the ART value (while I do not know if possible and if why)? As I've saved ART after initial flash (and not before) I cannot compare. -.- This is wrong ofc. 
Let's say it in other way: The MAC's in ART are clearly not uniqe. So maybe OpenWrt is deciding within a script which I'm not aware of to alter them because of this.
Is it worth to try to fix the values in ART if possible. Or does it nothing? For the AX3600 the values in ART are corresponding to those for wifi devices.
EDIT: BTW. We are not alone anymore: Adding Support for Verizon CR1000A - #583 by a_guy
So there is hope that others with deeper knowledge will find the issue. ^^