Everything needed is contained withing recent/current 'official' snapshots from OpenWrt.
However a step-by-step approach and some patience, is necessary.
Preface/prerequisite:
I already had the workaround in place (this made Phy-0 and Phy-1) usable.
Further endeavors, getting Phy-2 working:
-- Set "GB United Kingdom" as Country-code:
What I noticed was that Phy2 would crash when anything other than GB (Great Britain) was set as the reg-domain. (otherwise the log pointed to a invalid reg-domain).
-- Channel Selection messed up:
Next what I encountered is that for Phy-2, anything above CH-44 would result in the radio being configured to use 6Ghz. Which obviously the radio can't do
Thus the log showed 'invalid channel selection'.
-- Using Conservative settings:
With the above in mind, I set Phy-2 to CH44 / 40mhz-Wide (just to be safe) . Again, with reg-domain set to GB for all radio's, and then restarted Phy2.
--cac_time=600s:
Log now showed that Phy-2 was performing DFS_CAC. Now, normally this takes 60seconds, but log showed it would take 10-minutes, I decided to wait.
About 10 Minutes Later Phy-2 was up and broadcasting SSID but signal was really weak.
Workaround-part-2:
Workaround was needed once more:
Recognizing the issue (Phy-2 TX-signal being really weak as the one mentioned on the Buffalo's Wikipage) I performed the workaround once-more, taking into account the changes I made the first time around:
mv /lib/firmware/ath11k/IPQ8074/hw2.0/cal-abh-c000000.wifi.bin /lib/firmware/ath11k/IPQ8074/hw2.0/_IGNORE_cal-ahb-c000000.wifi.bin
. /lib/functions/caldata.sh
FIRMWARE=ath11k/IPQ8074/hw2.0/board.bin caldata_extract "0:art" 0x1000 0x20000
reboot
After rebooting Phy-2 is perfectly usable.
The issue with channel selection (Phy2 being instructed to transmit at 6Ghz when - for instance- selecting channel 64) is gone. Selecting Channel 100 now results in radio actually working at 5500Mhz.
Furthermore the Phy2 will broadcast at a reasonable and usable 25dBm
Observations:
--So it seems that you need to get Phy2 in (basic/minimal) working order. That's a hard prerequisite; you have to get it working on a minimal (conservative) level in terms of settings.
--In short: the mechanisms involving firmware/data/drive loading seem a bit quirky; as seen (in this case) Phy2 needs to be in a (minimal) working state in order to feed it the factory calibration data.
-- Although this workaround extracts pre-caldata a the second time and rebooting is a necessity to make the device fully functional. The pre-caldata is not any different.
-- Thus(again) it seems that the (pre-)caldata when fed in to the BDF can only be of use if The Phy already is in a minimal working state.
-- Time for DFS_CAC may take 10 minutes , this is before you have applied 'Workaround-part2'; be patient wait for Phy2 to be enabled.
-- GB region means the MX4200 adheres to DFS-ETSI standards (at least after 'workaround-part-2' it does).
-- Have Patience and look at OpenWrt's log.