Thought this may be of interest to anyone thinking of, or actually working on, this device.
It's a dual-SoC device with a MIPS SoC handling the xDSL and an ARM SoC handling the wifi and ethernet side of things.
Anyway, I've been given a beta firmware image to test out UK IPv6 support of /56 subnets and when I telnetted into the router IP I saw a new option ... sh
This gave me access to a shell with access to the actual filesystem of the device - I'm assuming the latter ARM SoC, but might give some clues as to how this communicates with the MIPS xDSL SoC.
If you email TP-Link they'll send you out a rar file with the new firmware.