Hello 
I just got this wdr3600 on my desk which had a sticker on it "bootloader defect"?.
Just soldered some pin headers and connected via serial to it:
U-Boot 1.1.4 (Sep 9 2013 - 14:28:41)
U-boot DB120
DRAM: 128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
PCIe Reset OK!!!!!!
In: serial
Out: serial
Err: serial
Net: ag934x_enet_initialize...
No valid address in Flash. Using fixed address
wasp reset mask:c03300
WASP ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
## Booting image at 9f020000 ...
Uncompressing Kernel Image ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover
Doesn't look to bad - a boot loader is actually present and works by the looks of it.
Next step was to interrupt the "Autobooting" and ask for help
U-Boot 1.1.4 (Sep 9 2013 - 14:28:41)
U-boot DB120
DRAM: 128 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
PCIe Reset OK!!!!!!
In: serial
Out: serial
Err: serial
Net: ag934x_enet_initialize...
No valid address in Flash. Using fixed address
wasp reset mask:c03300
WASP ----> S17 PHY *
: cfg1 0x7 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs17_reg_init: complete
eth0 up
eth0
Autobooting in 1 seconds
db12x> help
? - alias for 'help'
bootm - boot application image from memory
cp - memory copy
erase - erase FLASH memory
help - print online help
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
reset - Perform RESET of the CPU
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
db12x>
Spotted tftpboot right away and gave it a shot:
db12x> tftpboot
*** Warning: no boot file name; using '6F01A8C0.img'
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename '6F01A8C0.img'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############################
done
Bytes transferred = 8126464 (7c0000 hex)
I used the file openwrt-21.02.3-ath79-generic-tplink_tl-wdr3600-v1-squashfs-factory.bin and renamed it to 6F01A8C0.img that the router ate it.
Next step boot it:
db12x> bootm
## Booting image at 81000000 ...
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 5.4.188 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16554-1d4dea6d4f)) #0 Sat Apr 16 12:59:34 2022
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[ 0.000000] MIPS: machine is TP-Link TL-WDR3600 v1
[ 0.000000] SoC: Atheros AR9344 rev 2
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 122180K/131072K available (5259K kernel code, 192K rwdata, 688K rodata, 1212K init, 205K bss, 8892K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] random: get_random_bytes called from 0x80661a28 with crng_init=0
[ 0.000000] CPU clock: 560.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns
[ 0.000009] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns
[ 0.008314] Calibrating delay loop... 278.78 BogoMIPS (lpj=557568)
[ 0.050864] pid_max: default: 32768 minimum: 301
[ 0.055960] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.063758] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.077162] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.087578] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.094937] pinctrl core: initialized pinctrl subsystem
[ 0.103186] NET: Registered protocol family 16
[ 0.137910] clocksource: Switched to clocksource MIPS
[ 0.144340] thermal_sys: Registered thermal governor 'step_wise'
[ 0.144718] NET: Registered protocol family 2
[ 0.155990] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.164545] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.173518] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.181691] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.189209] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.196106] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.203123] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.210844] NET: Registered protocol family 1
[ 0.215547] PCI: CLS 0 bytes, default 32
[ 0.223797] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.238270] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.244517] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.269375] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 0.281454] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[ 0.288522] gpio-export gpio-export: 4 gpio(s) exported
[ 0.294936] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.304331] printk: console [ttyS0] disabled
[ 0.308982] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[ 0.318184] printk: console [ttyS0] enabled
[ 0.318184] printk: console [ttyS0] enabled
[ 0.327093] printk: bootconsole [early0] disabled
[ 0.327093] printk: bootconsole [early0] disabled
[ 0.359888] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[ 0.364906] 3 fixed-partitions partitions found on MTD device spi0.0
[ 0.371367] Creating 3 MTD partitions on "spi0.0":
[ 0.376260] 0x000000000000-0x000000020000 : "u-boot"
[ 0.382412] 0x000000020000-0x0000007f0000 : "firmware"
[ 0.390703] 0x0000007f0000-0x000000800000 : "art"
[ 0.734903] switch0: Atheros AR8327 rev. 4 switch registered on mdio.0
[ 1.129904] random: fast init done
[ 1.320049] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
[ 1.331255] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
[ 1.338009] i2c /dev entries driver
[ 1.344412] NET: Registered protocol family 10
[ 1.354912] Segment Routing with IPv6
[ 1.358827] NET: Registered protocol family 17
[ 1.363441] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 1.376600] 8021q: 802.1Q VLAN Support v1.8
[ 1.381880] PCI host bridge /ahb/pcie-controller@180c0000 ranges:
[ 1.388147] MEM 0x0000000010000000..0x0000000013ffffff
[ 1.393466] IO 0x0000000000000000..0x0000000000000000
[ 1.398969] PCI host bridge to bus 0000:00
[ 1.403170] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[ 1.410156] pci_bus 0000:00: root bus resource [io 0x0000]
[ 1.415826] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 1.422720] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.430808] pci 0000:00:00.0: [168c:0033] type 00 class 0x028000
[ 1.436971] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit]
[ 1.443916] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[ 1.450802] pci 0000:00:00.0: supports D1
[ 1.454886] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[ 1.462127] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[ 1.468885] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64bit]
[ 1.476338] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pref]
[ 1.485758] hctosys: unable to open rtc device (rtc0)
[ 1.492054] /dev/root: Can't open blockdev
[ 1.496280] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 1.503888] Please append a correct "root=" boot option; here are the available partitions:
[ 1.512373] 1f00 128 mtdblock0
[ 1.512377] (driver?)
[ 1.519027] 1f01 8000 mtdblock1
[ 1.519030] (driver?)
[ 1.525671] 1f02 64 mtdblock2
[ 1.525673] (driver?)
[ 1.532312] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 1.540691] Rebooting in 1 seconds..
That looked much better than with the (old openwrt?) image loaded I got this device with - but still bootlooping 
Do these lines indicate a broken flash or something in that direction?
[ 1.492054] /dev/root: Can't open blockdev
[ 1.496280] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 1.503888] Please append a correct "root=" boot option; here are the available partitions:
[ 1.512373] 1f00 128 mtdblock0
[ 1.512377] (driver?)
[ 1.519027] 1f01 8000 mtdblock1
[ 1.519030] (driver?)
[ 1.525671] 1f02 64 mtdblock2
[ 1.525673] (driver?)
[ 1.532312] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
Some one who had this error in the past were able to fix it in software by the looks of it:
https://dev.archive.openwrt.org/ticket/18541
