Unfortunately, this does not work, please see below:
IPQ807x# printenv
CountryCode=HU
Router_unconfigured=0
SN=34289/F1S604517
atf=1
boot_wait=on
bootargs=ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs rootwait
bootcmd=tftp
bootdelay=5
color=100
eth1addr=64:64:4a:a0:5a:3c
eth2addr=64:64:4a:a0:5a:3c
eth3addr=64:64:4a:a0:5a:3c
eth4addr=64:64:4a:59:53:7c
eth5addr=64:64:4a:59:53:7c
ethact=eth0
ethaddr=64:64:4a:a0:5a:3c
fdt_high=0x4A400000
fdtcontroladdr=4a977f90
flag_boot_rootfs=1
flag_boot_success=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_try_sys1_failed=0
flag_try_sys2_failed=0
flash_type=2
fsbootargs=ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs
ipaddr=192.168.31.1
load_addr=44000000
machid=8010012
miot_did=444662168
miot_key=HdqqJZrwI8RxXHSQ
mode=Router
model=RA70
mtddevname=fs
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x3800000@0x4980000(fs),
no_wifi_dev_times=0
nv_sys_pwd=a671b7ae34ff1ad9bc001f572e0648ef47fe6e0a
nv_wan_type=dhcp
nv_wifi_enc=psk2
nv_wifi_enc1=psk2
nv_wifi_pwd=12345678
nv_wifi_pwd1=12345678
nv_wifi_ssid=Xiaomi_537C
nv_wifi_ssid1=Xiaomi_537C_5G_Game
partition=nand0,0
restore_defaults=0
serverip=192.168.31.100
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
ssh_en=1
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
telnet_en=1
uart_en=1
wl0_radio=1
wl0_ssid=xiaomi-router-ra70_miap537c_5G
wl1_radio=1
wl1_ssid=xiaomi-router-ra70_miap537c
wl2_ssid=xiaomi-router-ra70_537c_Game
Environment size: 1554/65532 bytes
IPQ807x# reset
resetting ...
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2734 - bootable_media_detect_entry, Start
B - 3439 - bootable_media_detect_success, Start
B - 3444 - elf_loader_entry, Start
B - 6105 - auth_hash_seg_entry, Start
B - 43638 - auth_hash_seg_exit, Start
B - 105464 - elf_segs_hash_verify_entry, Start
B - 168320 - PBL, End
B - 266631 - SBL1, Start
B - 343613 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 353220 - pm_device_init, Start
B - 530578 - PM_SET_VAL:Skip
D - 175527 - pm_device_init, Delta
B - 532987 - pm_driver_init, Start
D - 5337 - pm_driver_init, Delta
B - 539301 - clock_init, Start
D - 2104 - clock_init, Delta
B - 543327 - boot_flash_init, Start
D - 12505 - boot_flash_init, Delta
B - 559614 - boot_config_data_table_init, Start
D - 3080 - boot_config_data_table_init, Delta - (575 Bytes)
B - 567086 - Boot Setting : 0x00000600
B - 571021 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 578036 - sbl1_ddr_set_params, Start
B - 581757 - CPR configuration: 0x300
B - 585234 - cpr_init, Start
B - 588101 - Rail:0 Mode: 5 Voltage: 816000
B - 593194 - CL CPR settled at 768000mV
B - 596092 - Rail:1 Mode: 5 Voltage: 880000
B - 600270 - Rail:1 Mode: 7 Voltage: 912000
D - 16500 - cpr_init, Delta
B - 607163 - Pre_DDR_clock_init, Start
B - 611159 - Pre_DDR_clock_init, End
B - 614544 - DDR Type : PCDDR3
B - 620187 - do ddr sanity test, Start
D - 1067 - do ddr sanity test, Delta
B - 625036 - DDR: Start of HAL DDR Boot Training
B - 629672 - DDR: End of HAL DDR Boot Training
B - 635467 - DDR: Checksum to be stored on flash is -314266808
B - 645776 - Image Load, Start
D - 507063 - QSEE Image Loaded, Delta - (1381328 Bytes)
B - 1152930 - Image Load, Start
D - 61 - SEC Image Loaded, Delta - (0 Bytes)
B - 1160616 - Image Load, Start
D - 293776 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B - 1454453 - Image Load, Start
D - 305031 - RPM Image Loaded, Delta - (93060 Bytes)
B - 1759545 - Image Load, Start
D - 376949 - APPSBL Image Loaded, Delta - (583214 Bytes)
B - 2136616 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 2142411 - USB D+ check, Start
D - 0 - USB D+ check, Delta
B - 2148816 - SBL1, End
D - 1884473 - SBL1, Delta
S - Flash Throughput, 6726 KB/s (2091397 Bytes, 310940 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2016.01 (May 08 2021 - 02:53:50 +0000), Build: jenkins-common_router_openwrt_ota_publish-1177
DRAM: smem ram ptable found: ver: 1 len: 4
1 GiB
NAND: Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI Link Intialized
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010012
MMC Device 0 not found
bootwait is on, bootdelay=5
Hit any key to stop autoboot: 0
trigger button release!
secure boot fuse is enabled
boot from rootfs 1
miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 56 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 4/2, WL threshold: 4096, image sequence number: 1048937200
ubi0: available PEBs: 313, total reserved PEBs: 135, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 42000000
No size specified -> Using max size (11554816)
## Loading kernel from FIT Image at 42000000 ...
Using 'config@hk14' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.15.90
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x420000e8
Data Size: 11495888 Bytes = 11 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41000000
Entry Point: 0x41000000
Hash algo: crc32
Hash value: 870e77c0
Hash algo: sha1
Hash value: 4103154b8920222bfbb2623e7ad4fedf556d0061
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 42000000 ...
Using 'config@hk14' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt xiaomi_ax9000 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x42af6bf8
Data Size: 45349 Bytes = 44.3 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 002971e3
Hash algo: sha1
Hash value: f60a148d35ee1e95275bc3df963c22ac076ca05c
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x42af6bf8
Uncompressing Kernel Image ... OK
ERROR: new format image overwritten - must RESET the board to recover
resetting ...
Interestingly, the load_addr=44000000 was there from the beginning.