I've found a flash dump from vr2600v posted by @robimarko posted back in 2020.
https://forum.openwrt.org/t/need-full-dump-tp-link-archer-vr2600-installation/48081/23
Comparing the vr2600v flash dump to the vr2600v recovery image, it appears the kernel actually begins at 0x320200 within the OEM firmware recovery file, and not at 0x320400 as suggested by binwalk.
I compared the flash dump to the recovery image, Archer_VR2600vv1_1.4.0_0.8.0_up_boot(170628)_2017-06-28_16.03.13.bin
The kernel+rootfs areas appear identical at first glance. However, the flash dump includes additional code in the kernel.
I don't know where this code came from and as it is in the kernel area, I guess it is created by an unidentified routine when the firmware is written to the flash.