Too few good blocks within range

Following https://openwrt.org/toh/linksys/mr8300#upgrade_from_openwrt_2203_to_the_last_version to prepare for an upgrade to 23.xx I ran fw_printenv, but it gave me Too few good blocks within range error. I got the same error when running fw_setenv kernsize 500000 and Error: environment not initialized in addition to that.

The device (Linksys MR8300) works normally.

The ubinfo -a gives me:

UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     680 (86343680 bytes, 82.3 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  40
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            245:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        36 LEBs (4571136 bytes, 4.3 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 245:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        600 LEBs (76185600 bytes, 72.6 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 245:2

and cat /proc/cmdline produces:

init=/sbin/init rootfstype=ubifs ubi.mtd=11,2048 root=ubi0:ubifs rootwait rw root=/dev/ubiblock0_0 rootfstype=squashfs ro

So I'm not really sure what is the issue and how to prepare for 23.xx.

Do you get any broken block notices in dmesg?

u_env/ s_env (if I read eboot-envtools correctly, this would be changing s_env, while I'd expect u_env to require changing) is outside the ubi volume, so different ECC rules apply. It would be interesting to see what happens if you'd use the bootloader (over serial console) to set the changed variables, but that's less trivial, of course.

Disclaimer: I don't own the device in question, so the above is just generic advice.

I'm a bit out of my depth here, but as far as I can tell there are no mentions about broken blocks in dmesg. The u_env/s_env is this:

[    1.259195] 0x000000680000-0x000000700000 : "u_env"
[    1.262935] 0x000000700000-0x000000740000 : "s_env"
full dmesg output
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.10.146 (builder@buildhost) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 11.2.0 r19803-9a599fee93) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri Oct 14 22:44:41 2022
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: Linksys MR8300 (Dallas)
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000080000000-0x000000009fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000080000000-0x0000000087dfffff]
[    0.000000]   node   0: [mem 0x0000000087e00000-0x0000000087ffffff]
[    0.000000]   node   0: [mem 0x0000000088000000-0x000000009fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x000000009fffffff]
[    0.000000] On node 0 totalpages: 131072
[    0.000000]   Normal zone: 1152 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 131072 pages, LIFO batch:31
[    0.000000] percpu: Embedded 15 pages/cpu s30860 r8192 d22388 u61440
[    0.000000] pcpu-alloc: s30860 r8192 d22388 u61440 alloc=15*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129920
[    0.000000] Kernel command line: init=/sbin/init rootfstype=ubifs ubi.mtd=11,2048 root=ubi0:ubifs rootwait rw root=/dev/ubiblock0_0 rootfstype=squashfs ro
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 506816K/524288K available (6446K kernel code, 608K rwdata, 952K rodata, 1024K init, 246K bss, 17472K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000025] Switching to timer-based delay loop, resolution 20ns
[    0.000331] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000359] pid_max: default: 32768 minimum: 301
[    0.000545] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000565] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001581] CPU: Testing write buffer coherency: ok
[    0.001948] qcom_scm: convention: smc legacy
[    0.002902] Setting up static identity map for 0x80300000 - 0x8030003c
[    0.003065] rcu: Hierarchical SRCU implementation.
[    0.003328] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.003696] smp: Bringing up secondary CPUs ...
[    0.007190] smp: Brought up 1 node, 4 CPUs
[    0.007216] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.007226] CPU: All CPU(s) started in SVC mode.
[    0.012273] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.012439] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.012464] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.012702] pinctrl core: initialized pinctrl subsystem
[    0.014509] NET: Registered protocol family 16
[    0.014938] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.016038] thermal_sys: Registered thermal governor 'step_wise'
[    0.016463] cpuidle: using governor ladder
[    0.016520] cpuidle: using governor menu
[    0.043079] cryptd: max_cpu_qlen set to 1000
[    0.047399] usbcore: registered new interface driver usbfs
[    0.047480] usbcore: registered new interface driver hub
[    0.047540] usbcore: registered new device driver usb
[    0.047593] pps_core: LinuxPPS API ver. 1 registered
[    0.047606] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti 
[    0.047637] PTP clock support registered
[    0.049609] clocksource: Switched to clocksource arch_sys_counter
[    0.050647] NET: Registered protocol family 2
[    0.050922] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.052061] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.052127] TCP established hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.052192] TCP bind hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.052285] TCP: Hash tables configured (established 4096 bind 4096)
[    0.052425] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.052469] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.052752] NET: Registered protocol family 1
[    0.052802] PCI: CLS 0 bytes, default 64
[    0.055311] workingset: timestamp_bits=14 max_order=17 bucket_order=3
[    0.059876] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.059901] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.194923] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.197161] qcom-pcie 40000000.pci: host bridge /soc/pci@40000000 ranges:
[    0.197221] qcom-pcie 40000000.pci:       IO 0x0040200000..0x00402fffff -> 0x0040200000
[    0.197252] qcom-pcie 40000000.pci:      MEM 0x0040300000..0x0040ffffff -> 0x0040300000
[    0.471170] qcom-pcie 40000000.pci: Link up
[    0.471334] qcom-pcie 40000000.pci: PCI host bridge to bus 0000:00
[    0.471357] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.471378] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0x40200000-0x402fffff])
[    0.471394] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff]
[    0.471447] pci 0000:00:00.0: [17cb:1001] type 01 class 0x060400
[    0.471479] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    0.471552] pci 0000:00:00.0: PME# supported from D0 D3hot
[    0.473079] PCI: bus0: Fast back to back transfers disabled
[    0.473405] pci 0000:01:00.0: [168c:0056] type 00 class 0x028000
[    0.473584] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.474417] pci 0000:01:00.0: PME# supported from D0 D3hot
[    0.476155] PCI: bus1: Fast back to back transfers disabled
[    0.476210] pci 0000:00:00.0: BAR 8: assigned [mem 0x40400000-0x405fffff]
[    0.476228] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff]
[    0.476253] pci 0000:01:00.0: BAR 0: assigned [mem 0x40400000-0x405fffff 64bit]
[    0.476344] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.476362] pci 0000:00:00.0:   bridge window [mem 0x40400000-0x405fffff]
[    0.479196] pcieport 0000:00:00.0: AER: enabled with IRQ 102
[    0.481359] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    0.481383] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    0.482758] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.482857] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[    0.482950] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.483040] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.483351] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.485156] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.485203] msm_serial 78af000.serial: uartclk = 1843200
[    0.485262] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 32, base_baud = 115200) is a MSM
[    0.485294] msm_serial: console setup on port #0
[    1.177856] printk: console [ttyMSM0] enabled
[    1.183073] msm_serial: driver initialized
[    1.191902] loop: module loaded
[    1.193562] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xda
[    1.193863] nand: Macronix MX30LF2G18AC
[    1.200507] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.204033] Block protection check failed
[    1.211780] 16 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.215746] Creating 16 MTD partitions on "qcom_nand.0":
[    1.222555] 0x000000000000-0x000000100000 : "sbl1"
[    1.229703] 0x000000100000-0x000000200000 : "mibib"
[    1.234055] 0x000000200000-0x000000300000 : "qsee"
[    1.238787] 0x000000300000-0x000000380000 : "cdt"
[    1.243265] 0x000000380000-0x000000400000 : "appsblenv"
[    1.247965] 0x000000400000-0x000000480000 : "ART"
[    1.253052] 0x000000480000-0x000000680000 : "appsbl"
[    1.259195] 0x000000680000-0x000000700000 : "u_env"
[    1.262935] 0x000000700000-0x000000740000 : "s_env"
[    1.267265] 0x000000740000-0x000000780000 : "devinfo"
[    1.272200] 0x000000780000-0x000005f80000 : "kernel"
[    1.354529] 0x000000a80000-0x000005f80000 : "rootfs"
[    1.430299] mtd: device 11 (rootfs) set to be root filesystem
[    1.430629] mtdsplit: no squashfs found in "rootfs"
[    1.435050] 0x000005f80000-0x00000b780000 : "alt_kernel"
[    1.517932] 0x000006280000-0x00000b780000 : "alt_rootfs"
[    1.593593] 0x00000b780000-0x00000b880000 : "sysdiag"
[    1.595076] 0x00000b880000-0x00000ff00000 : "syscfg"
[    1.699685] ESS reset ok!
[    1.773866] ESS reset ok!
[    2.451022] EDMA using MAC@ - using
[    2.451038] 6a:4b:29:32:70:26
[    2.534853] i2c /dev entries driver
[    2.536684] sdhci: Secure Digital Host Controller Interface driver
[    2.537158] sdhci: Copyright(c) Pierre Ossman
[    2.543491] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.551913] NET: Registered protocol family 10
[    2.555139] Segment Routing with IPv6
[    2.557896] NET: Registered protocol family 17
[    2.561666] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.565902] 8021q: 802.1Q VLAN Support v1.8
[    2.579167] Registering SWP/SWPB emulation handler
[    2.593816] ubi0: attaching mtd11
[    3.188036] ubi0: scanning is finished
[    3.204328] ubi0: attached mtd11 (name "rootfs", size 85 MiB)
[    3.204421] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.209114] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.216029] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.222794] ubi0: good PEBs: 680, bad PEBs: 0, corrupted PEBs: 0
[    3.229512] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    3.235827] ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1665787481
[    3.242856] ubi0: available PEBs: 0, total reserved PEBs: 680, PEBs reserved for bad PEB handling: 40
[    3.252244] ubi0: background thread "ubi_bgt0d" started, PID 124
[    3.262124] block ubiblock0_0: created from ubi0:0(rootfs)
[    3.273260] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    3.275260] Freeing unused kernel memory: 1024K
[    3.300001] Run /sbin/init as init process
[    3.300035]   with arguments:
[    3.300043]     /sbin/init
[    3.300049]   with environment:
[    3.300056]     HOME=/
[    3.300065]     TERM=linux
[    3.728763] init: Console is alive
[    3.729089] init: - watchdog -
[    4.010883] random: crng init done
[    4.493657] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.590259] genirq: irq_chip msmgpio did not update eff. affinity mask of irq 103
[    4.817384] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    4.817475] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    4.822123] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f665 hci version 0x100 quirks 0x0000002002010010
[    4.829474] xhci-hcd xhci-hcd.0.auto: irq 105, io mem 0x08a00000
[    4.839939] hub 1-0:1.0: USB hub found
[    4.845016] hub 1-0:1.0: 1 port detected
[    4.848862] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    4.852658] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    4.857905] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
[    4.869910] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.872622] hub 2-0:1.0: USB hub found
[    4.880390] hub 2-0:1.0: 1 port detected
[    4.884508] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.887956] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3
[    4.893556] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220f665 hci version 0x100 quirks 0x0000002002010010
[    4.900888] xhci-hcd xhci-hcd.1.auto: irq 106, io mem 0x06000000
[    4.911032] hub 3-0:1.0: USB hub found
[    4.916442] hub 3-0:1.0: 1 port detected
[    4.920338] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.924049] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4
[    4.929345] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    4.937054] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.944071] hub 4-0:1.0: USB hub found
[    4.951834] hub 4-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    4.957611] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.970762] init: - preinit -
[    5.779201] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    9.986060] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    9.986348] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 209
[   10.036006] UBIFS (ubi0:1): recovery needed
[   10.161923] UBIFS (ubi0:1): recovery completed
[   10.162103] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[   10.165286] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   10.173230] UBIFS (ubi0:1): FS size: 74915840 bytes (71 MiB, 590 LEBs), journal size 3809280 bytes (3 MiB, 30 LEBs)
[   10.183102] UBIFS (ubi0:1): reserved for root: 3538460 bytes (3455 KiB)
[   10.193362] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 4DDC456A-0590-46C3-AC1C-FE424B6BAF85, small LPT model
[   10.205265] mount_root: switching to ubifs overlay
[   10.224651] urandom-seed: Seeding with /etc/urandom.seed
[   10.430156] procd: - early -
[   10.430440] procd: - watchdog -
[   11.059007] procd: - watchdog -
[   11.071281] procd: - ubus -
[   11.444814] procd: - init -
[   12.176628] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.246715] urngd: v1.0.2 started.
[   12.268585] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[   12.268633] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[   12.286074] usbcore: registered new interface driver usblp
[   12.342182] PPP generic driver version 2.4.2
[   12.343273] NET: Registered protocol family 24
[   12.361927] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x56.
[   12.362923] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142)
[   12.369477] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   13.650151] ath10k_pci 0000:01:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[   13.650203] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   13.662689] ath10k_pci 0000:01:00.0: firmware ver 10.4b-ct-9888-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 59e741e7
[   13.978901] ath10k_pci 0000:01:00.0: Loading BDF type 0
[   13.979894] ath10k_pci 0000:01:00.0: board_file api 2 bmi_id 0:23 crc32 1236d4f6
[   15.742126] ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   15.742187] ath10k_pci 0000:01:00.0: msdu-desc: 2500  skid: 32
[   15.796582] ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   15.797502] ath10k_pci 0000:01:00.0: wmi print 'free: 114572 iram: 12644 sram: 29508'
[   16.045598] ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   16.154550] ath: EEPROM regdomain: 0x833a
[   16.154564] ath: EEPROM indicates we should expect a country code
[   16.154576] ath: doing EEPROM country->regdmn map search
[   16.154584] ath: country maps to regdmn code: 0x37
[   16.154592] ath: Country alpha2 being used: GB
[   16.154598] ath: Regpair used: 0x37
[   17.537765] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   17.537822] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   17.549790] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   17.601458] ath10k_ahb a000000.wifi: Loading BDF type 0
[   17.629270] ath10k_ahb a000000.wifi: board_file api 2 bmi_id 0:20 crc32 92fcc3a6
[   18.916812] ath10k_ahb a000000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   18.916871] ath10k_ahb a000000.wifi: msdu-desc: 2500  skid: 32
[   18.965692] ath10k_ahb a000000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   18.967674] ath10k_ahb a000000.wifi: wmi print 'free: 53252 iram: 13432 sram: 35752'
[   19.112781] ath10k_ahb a000000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   19.287040] ath: EEPROM regdomain: 0x833a
[   19.287059] ath: EEPROM indicates we should expect a country code
[   19.287074] ath: doing EEPROM country->regdmn map search
[   19.287088] ath: country maps to regdmn code: 0x37
[   19.287099] ath: Country alpha2 being used: GB
[   19.287107] ath: Regpair used: 0x37
[   20.019069] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   20.019134] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   20.032564] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   20.082751] ath10k_ahb a800000.wifi: Loading BDF type 0
[   20.083500] ath10k_ahb a800000.wifi: board_file api 2 bmi_id 0:21 crc32 92fcc3a6
[   21.375226] ath10k_ahb a800000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   21.375290] ath10k_ahb a800000.wifi: msdu-desc: 2500  skid: 32
[   21.424592] ath10k_ahb a800000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   21.426262] ath10k_ahb a800000.wifi: wmi print 'free: 53252 iram: 13432 sram: 35752'
[   21.565861] ath10k_ahb a800000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   21.731137] ath: EEPROM regdomain: 0x833a
[   21.731152] ath: EEPROM indicates we should expect a country code
[   21.731163] ath: doing EEPROM country->regdmn map search
[   21.731175] ath: country maps to regdmn code: 0x37
[   21.731183] ath: Country alpha2 being used: GB
[   21.731188] ath: Regpair used: 0x37
[   21.742722] kmodloader: done loading kernel modules from /etc/modules.d/*
[   29.225998] br-lan: port 1(eth0) entered blocking state
[   29.226024] br-lan: port 1(eth0) entered disabled state
[   29.226541] device eth0 entered promiscuous mode
[   29.341583] ess_edma c080000.edma eth1: Link is Down
[   30.052485] ath: EEPROM regdomain: 0x80cb
[   30.052509] ath: EEPROM indicates we should expect a country code
[   30.052520] ath: doing EEPROM country->regdmn map search
[   30.052537] ath: country maps to regdmn code: 0x37
[   30.052553] ath: Country alpha2 being used: CZ
[   30.052566] ath: Regpair used: 0x37
[   30.052583] ath: regdomain 0x80cb dynamically updated by user
[   30.052629] ath: EEPROM regdomain: 0x80cb
[   30.052641] ath: EEPROM indicates we should expect a country code
[   30.052656] ath: doing EEPROM country->regdmn map search
[   30.052671] ath: country maps to regdmn code: 0x37
[   30.052680] ath: Country alpha2 being used: CZ
[   30.052686] ath: Regpair used: 0x37
[   30.052695] ath: regdomain 0x80cb dynamically updated by user
[   30.052778] ath: EEPROM regdomain: 0x80cb
[   30.052786] ath: EEPROM indicates we should expect a country code
[   30.052793] ath: doing EEPROM country->regdmn map search
[   30.052800] ath: country maps to regdmn code: 0x37
[   30.052807] ath: Country alpha2 being used: CZ
[   30.052812] ath: Regpair used: 0x37
[   30.052820] ath: regdomain 0x80cb dynamically updated by user
[   30.249729] br-lan: port 1(eth0) entered blocking state
[   30.249751] br-lan: port 1(eth0) entered forwarding state
[   30.250142] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   31.451202] ess_edma c080000.edma eth1: Link is Up - 100Mbps/Full - flow control off
[   32.401716] ath10k_ahb a000000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   32.401771] ath10k_ahb a000000.wifi: msdu-desc: 2500  skid: 32
[   32.452734] ath10k_ahb a000000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   32.453101] ath10k_ahb a000000.wifi: wmi print 'free: 53252 iram: 13432 sram: 35752'
[   32.821894] ath10k_ahb a000000.wifi: rts threshold -1
[   32.824560] ath10k_ahb a000000.wifi: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
[   32.831740] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   33.003258] ath10k_ahb a000000.wifi: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   35.421704] ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   35.421759] ath10k_pci 0000:01:00.0: msdu-desc: 2500  skid: 32
[   35.476474] ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   35.478050] ath10k_pci 0000:01:00.0: wmi print 'free: 114572 iram: 12644 sram: 29508'
[   35.802867] ath10k_pci 0000:01:00.0: rts threshold -1
[   35.805112] ath10k_pci 0000:01:00.0: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
[   35.827249] br-lan: port 2(wlan0) entered blocking state
[   35.827272] br-lan: port 2(wlan0) entered disabled state
[   35.827907] device wlan0 entered promiscuous mode
[   44.581130] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   44.805664] br-lan: port 3(wlan1-1) entered blocking state
[   44.805686] br-lan: port 3(wlan1-1) entered disabled state
[   44.806161] device wlan1-1 entered promiscuous mode
[   44.807693] ath10k_ahb a000000.wifi: rts threshold -1
[   44.811246] br-lan: port 3(wlan1-1) entered blocking state
[   44.811268] br-lan: port 3(wlan1-1) entered forwarding state
[   44.963430] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1-1: link becomes ready
[   97.324586] ath10k_ahb a000000.wifi: Invalid peer id 1 or peer stats buffer, peer: 873101bb  sta: 00000000
[  100.336522] ath10k_pci 0000:01:00.0: mac flush null vif, drop 0 queues 0xffff
[  100.458075] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  100.458327] br-lan: port 2(wlan0) entered blocking state
[  100.458345] br-lan: port 2(wlan0) entered forwarding state
[  268.219096] ath10k_ahb a000000.wifi: wmi: fixing invalid VHT TX rate code 0xff
[  499.669103] usb 1-1: new high-speed USB device number 2 using xhci-hcd
[  499.876571] usblp 1-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 2 vid 0x03F0 pid 0x2B17
[40889.844084] ath10k_ahb a000000.wifi: Invalid VHT mcs 15 peer stats
[44941.708819] usb 1-1: USB disconnect, device number 2
[44941.714652] usblp0: removed
[54405.439890] ath10k_ahb a000000.wifi: htt tx: fixing invalid VHT TX rate code 0xff

I'm still having this problem, which now prevents me from upgrading to 23.05 since I can't do fw_setenv kernsize 500000 as suggested on wiki.

I successfully flashed the device with the latest 22 (22.03.7) and after power-cycling the device I managed to switch to the 22.03.7. However the Too few good blocks within range error is there too.

Just a note that I couldn't use the luci-app-advanced-reboot since it seems it is using the fw_setenv, which makes it report both partitions as Alternative and when I click on "Reboot to alternative partition..." button, I get Unable to obtain firmware environment variable: . alert message in LuCI and nothing happens.

I'd really like to avoid using serial terminal, since I wouldn't know what I'm doing and don't have the necessary equipment. That being said, I'm willing to try anything else, but I fear it might be the HW issue even though the router works just fine.

I have, of course, run into this exact same issue with my EA8300 and was just wondering if you've had any breakthroughs since your post here? If not, I plan on taking a whack at it over serial and I'll post any updates here.

Edit: A few hours of tinkering later, and it's done. Serial is, unfortunately, the answer here, and it was as simple as connecting to the serial port on the router's mainboard, interrupting the boot sequence to gain the U-Boot shell and passing the following commands:

setenv kernsize 500000
saveenv

You can then double check that the changes have taken effect with:

printenv

And finally, to reset the router:

reset

After the router reboots, you will still get the same warning on the upgrade screen when you attempt to upgrade via the LuCI, but you can just follow the instructions for force-flashing the factory image from the command line (SSH) which will now work.