Thanks for the help. I followed the instructions, although I struggled since for context my ethernet cable goes up to my Xiaomi router, which then "shares" it with PC. Therefore, I wasn't sure what setup to adopt, and tried multiple times.
At the end I "gave up" and just rebooted one last time... Turn out it worked, although not the intended way. I saw I was on 1.30, so the original firmware !
Installing OpenWRT from there was easy-peasy.
root@XiaoQiang:/tmp# nanddump /dev/mtd0
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Not printing binary garbage to tty. Use '-a'
or '--forcebinary' to override.
So even if nanddump says 0 bad blocks, this specific device could still be bricked by openwrt?
Yes.
users may encounter program failure issue. This issue
is not always reproducible, but it may occur and cause system instability.
There is nothing about bad blocks there.
2. @itdoginfo reported that their FORESEE device got bricked despite of no bad blocks in the nandump test.
Seems it's not a DHCP server issue as the uploaded firmware just resets, that explains the no-carrier on the network interface.
Should a different FIP be flashed to the board? I try to catch the command line of u-boot but seems it's set to zero so neither Enter nor Ctrl+C pops the shell.
mtk_uartboot -s /dev/ttyUSB2 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && screen -L /dev/ttyUSB2 115200
...
NOTICE: BL31: v2.12.0(release):OpenWrt v2025.02.12~e0907706-1 (mt7981-spim-nand-ddr3)
NOTICE: BL31: Built : 18:23:15, Mar 29 2025
U-Boot 2025.01-OpenWrt-r29105-6ac09b940f (Mar 29 2025 - 18:23:15 +0000)
CPU: MediaTek MT7981
Model: Xiaomi Router AX3000T
DRAM: 256 MiB
Core: 39 devices, 18 uclasses, devicetree: embed
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
ubi0 error: ubi_add_to_av: two LEBs with same sequence number 1
eraseblock attaching information dump:
ec 1
pnum 0
lnum 0
scrub 0
sqnum 1
Volume identifier header dump:
magic 55424921
version 1
vol_type 1
copy_flag 0
compat 5
vol_id 2147479551
lnum 0
data_size 0
used_ebs 0
data_pad 0
sqnum 1
hdr_crc 65b3bd2d
Volume identifier header hexdump:
00000000: 55 42 49 21 01 01 00 05 7f ff ef ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 UBI!............................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 65 b3 bd 2d ............................e..-
ubi0 error: ubi_attach_mtd_dev: failed to attach mtd8, error -22
UBI error: cannot attach mtd8
UBI error: cannot initialize UBI, error -22
UBI init error 22
Please check, if the correct MTD partition is used (size big enough?)
** Cannot find mtd partition "ubi"
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
reset button found
Loading Environment from UBI... ubi0 error: ubi_add_to_av: two LEBs with same sequence number 1
eraseblock attaching information dump:
ec 1
pnum 0
lnum 0
scrub 0
sqnum 1
Volume identifier header dump:
magic 55424921
version 1
vol_type 1
copy_flag 0
compat 5
vol_id 2147479551
lnum 0
data_size 0
used_ebs 0
data_pad 0
sqnum 1
hdr_crc 65b3bd2d
Volume identifier header hexdump:
00000000: 55 42 49 21 01 01 00 05 7f ff ef ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 UBI!............................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 65 b3 bd 2d ............................e..-
ubi0 error: ubi_attach_mtd_dev: failed to attach mtd8, error -22
UBI error: cannot attach mtd8
UBI error: cannot initialize UBI, error -22
UBI init error 22
Please check, if the correct MTD partition is used (size big enough?)
** Cannot find mtd partition "ubi"
Net: MediaTek MT7531
Warning: ethernet@15100000 (eth0) using random MAC address - 32:dc:d9:f0:2f:96
eth0: ethernet@15100000
Error, no UBI device selected!
Error, no UBI device selected!
Erasing 0x00000000 ... 0x06ffffff (896 eraseblock(s))
resetting ...
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL
NOTICE: BL2: v2.6(release):9548a30134d-dirty
NOTICE: BL2: Built : 02:27:18, Jan 24 2024
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings
dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000
dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 596, worse bit 2, min window 72
Window Sum 580, worse bit 8, min window 72
Window Sum 414, worse bit 6, min window 50
Window Sum 344, worse bit 15, min window 38
Window Sum 430, worse bit 0, min window 52
Window Sum 346, worse bit 10, min window 42
Window Sum 354, worse bit 15, min window 42
Window Sum 436, worse bit 0, min window 52
Window Sum 452, worse bit 0, min window 54
Window Sum 368, worse bit 9, min window 44
Window Sum 380, worse bit 15, min window 44
Window Sum 384, worse bit 15, min window 44
Window Sum 392, worse bit 11, min window 46
Window Sum 458, worse bit 2, min window 56
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xc8
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: Initializing NMBM ...
NOTICE: Signature found at block 1023 [0x07fe0000]
NOTICE: First info table with writecount 0 found in block 960
NOTICE: Second info table with writecount 0 found in block 963
NOTICE: NMBM has been successfully attached in read-only mode
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):9548a30134d-dirty
NOTICE: BL31: Built : 02:27:18, Jan 24 2024
NOTICE: Hello BL31!!
Thanks for the explanation for dummies. 
IMO the wiki warning should not mention 1% chance or bad blocks at all.
I would have interpreted that as "if nanddump doesn't report any bad blocks I have a 99% chance of success flashing openwrt without brick" which seems to be quite far from the truth.
Foresee RD03 stood firmware 1.0.84 (CN)
Updated to 1.0.91 (CN)
The first time I sewed Openwrt through the xmir-patcher-main, successfully
After the firmware 24.10.1 on the U-Boot, the router became brick 
Restored through the USB-UART CH340 adapter
Installed Snapshot
And only then did he start
This is the seventh router of this model that I flashed
Before that, everything was always successful
I have RD03 ESMT which I initially flashed it with 23.05.4+u-boot. I previously upgraded it to 23.05.5 without issue. I upgraded it to 24.10.0 when it first released; while everyday usage is fine, I notice the sysupgrade is now broken and I couldn't upgrade to 24.10.1.
ubus call system sysupgrade '{ "prefix": "\/tmp\/root", "path": "\/tmp\/firmware.bin", "backup": "\/tmp\/sysupgrade.tgz", "command": "/lib/upgrade/do_stage2", "options": { "save_partitions": 1 } }'`
Command failed: Connection failed
The router immediately reboots at this step, regardless of -n option.
Other topics that mention similar issue: 1, 2, 3. 4
I'm trying to sysupgrade from recovery. Not familiar with recovery mode, I'm searching around past replies.
Edit: Seems similar to an issue affecting some users of AX6000 also on 24.10.0. So, I flashed 23.05.5 recovery
opkg update && opkg install kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
ubiupdatevol /dev/ubi0_2 /tmp/openwrt-23.05.5-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
I booted into recovery (power off, power on while holding reset button for 10 seconds) and flashed 24.10.1 with sysupgrade -v -n. I still got Command failed: Connection failed, but after finished booting up, I ssh in and noticed the banner is "OpenWrt 24.10.1". I initially thought the sysupgrade I ran only applied to recovery and the router might still in recovery mode, but luci is accessible which also shows 24.10.1.
I restored my backup, reboot, luci still shows 24.10.1 and internet is working.
or maybe you just need to install the fitblk package?
Hello, I'm having a problem after trying to restore my AX3000T RD03 to stock firmware.
I used the tutorial here "Go Back to stock from OpenWrt U-Boot." here The orange light flashes continuously, and nothing happens. On the terminal side, I get information at startup, then nothing.
After some thought, I realized that I had installed version 1.0.49 (INT) when I should have installed 1.0.47 (CN).
Could this explain my problem?
If I set up a DHCP server, I can see that it retrieves an IP address but nothing else. Do you have a recovery procedure?
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL
NOTICE: BL2: v2.6(release):e233a3d581-dirty
NOTICE: BL2: Built : 06:23:27, Jul 30 2023
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings
dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000
dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 576, worse bit 0, min window 72
Window Sum 548, worse bit 8, min window 68
Window Sum 430, worse bit 2, min window 52
Window Sum 388, worse bit 11, min window 46
Window Sum 440, worse bit 2, min window 54
Window Sum 394, worse bit 11, min window 46
Window Sum 442, worse bit 2, min window 54
Window Sum 402, worse bit 11, min window 48
Window Sum 448, worse bit 5, min window 54
Window Sum 408, worse bit 11, min window 48
Window Sum 416, worse bit 11, min window 50
Window Sum 460, worse bit 3, min window 56
Window Sum 422, worse bit 11, min window 50
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xc8
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: Initializing NMBM ...
NOTICE: Signature found at block 1023 [0x07fe0000]
NOTICE: First info table with writecount 0 found in block 960
NOTICE: Second info table with writecount 0 found in block 963
NOTICE: NMBM has been successfully attached in read-only mode
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):e233a3d581-dirty
NOTICE: BL31: Built : 06:23:27, Jul 30 2023
NOTICE: Hello BL31!!!
you may not have erased the bootloader, then try this option to return to the original firmware.
I brought one router back to life using this method, I also had an orange lamp flashing.
Hello, thank you very much, in fact I had done the meeting correctly. The router was waiting for me to connect to the wifi to customize the configuration. Thank you very much
Why would anyone restore this model to stock firmware?
There are a few reasons, such as:
(1) If you are getting rid of the router usually "regular people" expect the stock firmware.
(2) If anything happened to your OpenWRT install (e.g., being stuck in bootloader), returning to stock is an easy way to have a "clean slate" for flashing back OpenWRT.
Requests for help on how to restore to stock firmware should clarify the reason for doing so. Most of the time I reckon it's not necessary and will save both the helpee and helper times (and avoid problems like flashing the wrong region firmware as mentioned above).
hi everyone , im trying to unbrick my router , followed all the steps , putty test connection works fine , but the mtk uart boot command gets stuck at "Handshake..." ,
EDIT : Plugging in and turnin on the router when the handshake prompt is displayed solved it but now after booting the router ,
it would seems like its working fine , since the light would turn blue , but luci wont open , i can ping 192.168.1.1 , but when i try with the browser , it wont open , i fashed the last step , and booted from ram , but luci wont work . any help would be appreciated . thanks
If you have set a snapshot, then Luci will not open.
You did everything right, only the last step had to be installed 24.10.1 ubootmod-squashfs-sysupgrade.itb for U-Boot
if the usual option is not U-Boot, then 24.10.1 squashfs-sysupgrade.bin
Use Putty to take the last step to install the 24.10.1 update.
sysupgrade depends on fitblk? somehow it's not installed on the router, I shall install it then.
$ opkg update && opkg info fitblk
Package: fitblk
Version: 2
Depends: libc
Status: unknown ok not-installed
Section: base
Architecture: aarch64_cortex-a53
Size: 2900
Filename: fitblk_2_aarch64_cortex-a53.ipk
Description: Release uImage.FIT block devices using ioctl.
Without this file it is impossible to update to 24.X not Snapshot.
So yes, it can affect. This is an error when assembling-updating OpenWrt, since this file is not installed automatically as the same kernel, without which work is impossible.
this is the file installed in the last step of the unbricking tutorial , from wich the device boot and should be able to access luci
tftpboot 0x46000000 openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-kernel.bin
EDIT : updated some of the files from the github related page , and it did solve the issue .
thanks everyone