WNDR4300v2 - Trouble reverting to stock firmware

Installing and Using OpenWrt
1

My first attempt at this was uploading the stock firmware .img file, which gave a warning and so I forced it and that failed. When I checked on the serial console, it appeared OpenWRT was still installed, yet the web interface was showing a netgear logo but complaining that the file was not found.

I can use fw_recovery to get back to a working OpenWRT, but the the stock .img file doesn't seem to work. I've tried various things like using a tftp server, nmrpflash utility, but the router is in a strange state each time. It does seem to be running an earlier kernel after the fw_recovery, so I'm quite confused as to what is happening.

Here's a the log of when I tried fw_recovery

U-Boot 1.1.4 (Aug 12 2014 - 15:21:46)

U-boot dni29 V0.5 for DNI HW ID: 29764821 NOR flash 2MB NAND flash 128MB RAM 128MB
 - Dragonfly 1.0DRAM:  
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 265k for U-Boot at: 87fbc000
Reserving 192k for malloc() at: 87f8c000
Reserving 44 Bytes for Board Info at: 87f8bfd4
Reserving 36 Bytes for Global Data at: 87f8bfb0
Reserving 128k for boot params() at: 87f6bfb0
Stack Pointer at: 87f6bf98
Now running in RAM - U-Boot at: 87fbc000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x15
flash size 2MB, sector count = 32
Flash:  2 MB
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
ath_parse_read_id: SPI NAND V.Id: 0xc8 D.Id: 0xf1
====== NAND Parameters ======
sc = 0x87ff77e4 page = 0x800 block = 0x20000In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x87fe914c
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: a0:04:60:15:b7:43
eth0 up
eth0
Setting 0x181162c0 to 0x40802100
Hit any key to stop autoboot:  0 
ath> 
ath> 
ath> 
ath> 
ath> fw_recovery
Trying eth0
dup 1 speed 1000

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1...
            
Rcv:
	.................................................................

Done!
Bytes transferred = 14549125 (de0085 hex)
HW ID on board: 29764821+2+128+128+3x3+3x3+5508012175
HW ID on image: 29764821+2+128+128
Firmware Image HW ID matched Board HW ID

MODEL ID on board: WNDR4500series
MODEL ID on image: WNDR4500series
Firmware Image MODEL ID matched Board model ID

MODEL ID on board: WNDR4500series
MODEL ID on image: WNDR4500series
Firmware Image MODEL ID matched Board model ID

nand erase: off 0, size 20000: OK
nand write 0 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 20000, size 20000: OK
nand write 20000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 40000, size 20000: OK
nand write 40000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 60000, size 20000: OK
nand write 60000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 80000, size 20000: OK
nand write 80000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off a0000, size 20000: OK
nand write a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off c0000, size 20000: OK
nand write c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off e0000, size 20000: OK
nand write e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 100000, size 20000: OK
nand write 100000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 120000, size 20000: OK
nand write 120000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 140000, size 20000: OK
nand write 140000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 160000, size 20000: OK
nand write 160000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 180000, size 20000: OK
nand write 180000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 1a0000, size 20000: OK
nand write 1a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 1c0000, size 20000: OK
nand write 1c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 1e0000, size 20000: OK
nand write 1e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 200000, size 20000: OK
nand write 200000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 220000, size 20000: OK
nand write 220000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 240000, size 20000: OK
nand write 240000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 260000, size 20000: OK
nand write 260000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 280000, size 20000: OK
nand write 280000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 2a0000, size 20000: OK
nand write 2a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 2c0000, size 20000: OK
nand write 2c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 2e0000, size 20000: OK
nand write 2e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 300000, size 20000: OK
nand write 300000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 320000, size 20000: OK
nand write 320000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 340000, size 20000: OK
nand write 340000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 360000, size 20000: OK
nand write 360000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 380000, size 20000: OK
nand write 380000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 3a0000, size 20000: OK
nand write 3a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 3c0000, size 20000: OK
nand write 3c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 3e0000, size 20000: OK
nand write 3e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 400000, size 20000: OK
nand write 400000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 420000, size 20000: OK
nand write 420000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 440000, size 20000: OK
nand write 440000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 460000, size 20000: OK
nand write 460000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 480000, size 20000: OK
nand write 480000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 4a0000, size 20000: OK
nand write 4a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 4c0000, size 20000: OK
nand write 4c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 4e0000, size 20000: OK
nand write 4e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 500000, size 20000: OK
nand write 500000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 520000, size 20000: OK
nand write 520000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 540000, size 20000: OK
nand write 540000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 560000, size 20000: OK
nand write 560000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 580000, size 20000: OK
nand write 580000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 5a0000, size 20000: OK
nand write 5a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 5c0000, size 20000: OK
nand write 5c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 5e0000, size 20000: OK
nand write 5e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 600000, size 20000: OK
nand write 600000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 620000, size 20000: OK
nand write 620000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 640000, size 20000: OK
nand write 640000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 660000, size 20000: OK
nand write 660000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 680000, size 20000: OK
nand write 680000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 6a0000, size 20000: OK
nand write 6a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 6c0000, size 20000: OK
nand write 6c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 6e0000, size 20000: OK
nand write 6e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 700000, size 20000: OK
nand write 700000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 720000, size 20000: OK
nand write 720000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 740000, size 20000: OK
nand write 740000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 760000, size 20000: OK
nand write 760000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 780000, size 20000: OK
nand write 780000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 7a0000, size 20000: OK
nand write 7a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 7c0000, size 20000: OK
nand write 7c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 7e0000, size 20000: OK
nand write 7e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 800000, size 20000: OK
nand write 800000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 820000, size 20000: OK
nand write 820000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 840000, size 20000: OK
nand write 840000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 860000, size 20000: OK
nand write 860000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 880000, size 20000: OK
nand write 880000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 8a0000, size 20000: OK
nand write 8a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 8c0000, size 20000: OK
nand write 8c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 8e0000, size 20000: OK
nand write 8e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 900000, size 20000: OK
nand write 900000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 920000, size 20000: OK
nand write 920000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 940000, size 20000: OK
nand write 940000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 960000, size 20000: OK
nand write 960000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 980000, size 20000: OK
nand write 980000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 9a0000, size 20000: OK
nand write 9a0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 9c0000, size 20000: OK
nand write 9c0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off 9e0000, size 20000: OK
nand write 9e0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off a00000, size 20000: OK
nand write a00000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off a20000, size 20000: OK
nand write a20000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off a40000, size 20000: OK
nand write a40000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off a60000, size 20000: OK
nand write a60000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off a80000, size 20000: OK
nand write a80000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off aa0000, size 20000: OK
nand write aa0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off ac0000, size 20000: OK
nand write ac0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off ae0000, size 20000: OK
nand write ae0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off b00000, size 20000: OK
nand write b00000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off b20000, size 20000: OK
nand write b20000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off b40000, size 20000: OK
nand write b40000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off b60000, size 20000: OK
nand write b60000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off b80000, size 20000: OK
nand write b80000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off ba0000, size 20000: OK
nand write ba0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off bc0000, size 20000: OK
nand write bc0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off be0000, size 20000: OK
nand write be0000 : 20000 bytes written, OK
Alive-timer 0
nand erase: off c00000, size 20000: OK
nand write c00000 : 20000 bytes written, OK
timestamp overflows
Alive-timer 11
nand erase: off c20000, size 20000: OK
nand write c20000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off c40000, size 20000: OK
nand write c40000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off c60000, size 20000: OK
nand write c60000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off c80000, size 20000: OK
nand write c80000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off ca0000, size 20000: OK
nand write ca0000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off cc0000, size 20000: OK
nand write cc0000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off ce0000, size 20000: OK
nand write ce0000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off d00000, size 20000: OK
nand write d00000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off d20000, size 20000: OK
nand write d20000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off d40000, size 20000: OK
nand write d40000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off d60000, size 20000: OK
nand write d60000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off d80000, size 20000: OK
nand write d80000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off da0000, size 20000: OK
nand write da0000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off dc0000, size 20000: OK
nand write dc0000 : 20000 bytes written, OK
Alive-timer 11
nand erase: off de0000, size 20000: OK
nand write de0000 : 20000 bytes written, OK
Alive-timer 11
Done
Rebooting...

U-Boot 1.1.4 (Aug 12 2014 - 15:21:46)

U-boot dni29 V0.5 for DNI HW ID: 29764821 NOR flash 2MB NAND flash 128MB RAM 128MB
 - Dragonfly 1.0DRAM:  
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 265k for U-Boot at: 87fbc000
Reserving 192k for malloc() at: 87f8c000
Reserving 44 Bytes for Board Info at: 87f8bfd4
Reserving 36 Bytes for Global Data at: 87f8bfb0
Reserving 128k for boot params() at: 87f6bfb0
Stack Pointer at: 87f6bf98
Now running in RAM - U-Boot at: 87fbc000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x15
flash size 2MB, sector count = 32
Flash:  2 MB
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
ath_parse_read_id: SPI NAND V.Id: 0xc8 D.Id: 0xf1
====== NAND Parameters ======
sc = 0x87ff77e4 page = 0x800 block = 0x20000In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x87fe914c
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: a0:04:60:15:b7:43
eth0 up
eth0
Setting 0x181162c0 to 0x40802100
Hit any key to stop autoboot:  0 
Trying eth0
dup 1 speed 1000

 Client starts...[Listening] for ADVERTISE...checksum bad
TTT
Retry count exceeded; boot the image as usual

 nmrp server is stopped or failed !

Loading from device 0: ath-spi-nand (offset 0x0)

** check kernel image **
   Verifying Checksum ... OK

** check rootfs image **
   Verifying Checksum ... OK
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-2.6.31
   Created:      2019-07-15   7:43:38 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1167154 Bytes =  1.1 MB
   Load Address: 80002000
   Entry Point:  80280e00
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80280e00) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

Booting QCA956x
Linux version 2.6.31 (yaoheng.zhang@dnixm-compiler4) (gcc version 4.3.3 (GCC) ) #1 Mon Jul 15 15:43:25 CST 2019
flash_size passed from bootloader = 2
CPU revision is: 00019750 (MIPS 74Kc)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyS0,115200 rootfstype=squashfs board=WNDR4500v3 mtdparts=ath-nor0:256k(u-boot)ro,64k(u-boot-env)ro,64k(caldata_backup),64k(config),64k(traffic_meter),64k(pot),1408k(reserved),64k(caldata);ath-spi-nand:1152k(kernel),24448k(rootfs),25600k@0x0(firmware),2048k(language),128k(mtdoops),-(reserved)
PID hash table entries: 512 (order: 9, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 126236k/131072k available (2587k kernel code, 4656k reserved, 676k data, 152k init, 0k highmem)
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
plat_time_init: plat time init done
r4k_clockevent_init: Ignoring int_usable failure
Calibrating delay loop... 387.07 BogoMIPS (lpj=774144)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
ath_pcibios_init: bus 0
ath_pcibios_init(254): PCI 0 CMD write: 0x356
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: PME# supported from D0 D1 D3hot
pci 0000:00:00.0: PME# disabled
pcibios_map_irq: IRQ 76 for bus 0
NET: Registered protocol family 2
create ipmac proc
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 246
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
usbcore: registered new interface driver cdc_ether
8 cmdlinepart partitions found on MTD device ath-nor0
Creating 8 MTD partitions on "ath-nor0":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "u-boot-env"
0x000000050000-0x000000060000 : "caldata_backup"
0x000000060000-0x000000070000 : "config"
0x000000070000-0x000000080000 : "traffic_meter"
0x000000080000-0x000000090000 : "pot"
0x000000090000-0x0000001f0000 : "reserved"
0x0000001f0000-0x000000200000 : "caldata"
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
Nand_Vendor: 0xc8
6 cmdlinepart partitions found on MTD device ath-spi-nand
Creating 6 MTD partitions on "ath-spi-nand":
0x000000000000-0x000000120000 : "kernel"
0x000000120000-0x000001900000 : "rootfs"
mtd: find squashfs magic at 0x120000 of "ath-spi-nand"
the correct location of partition "rootfs": 0x000000120000-0x000001900000
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=DE0000, len=B20000 
0x000000de0000-0x000001900000 : "rootfs_data"
0x000000000000-0x000001900000 : "firmware"
0x000001900000-0x000001b00000 : "language"
0x000001b00000-0x000001b20000 : "mtdoops"
0x000001b20000-0x000008000000 : "reserved"
====== NAND Parameters ======
sc = 0x87915800 page = 0x800 block = 0x20000
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004 
ath-ehci ath-ehci.0: ATH EHCI
ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000 
ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000 
ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: ATH EHCI
usb usb1: Manufacturer: Linux 2.6.31 ehci_hcd
usb usb1: SerialNumber: platform
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Port Status 1c000000 
ath-ehci1 ath-ehci1.1: ATH EHCI
ath-ehci1 ath-ehci1.1: new USB bus registered, assigned bus number 2
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000 
ath-ehci1 ath-ehci1.1: irq 3, io mem 0x1b400000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000 
ath-ehci1 ath-ehci1.1: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: ATH EHCI
usb usb2: Manufacturer: Linux 2.6.31 ehci_hcd
usb usb2: SerialNumber: platform
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
Netfilter messages via NETLINK v0.30.
NAT Session Management application ports priority table is loaded!
nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
arch/mips/atheros/gpio.c (ath_simple_config_init) JUMPSTART_GPIO: 12
arch/mips/atheros/gpio.c (ath_simple_config_init) ATH_S17INT_GPIO: 10
athwdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:9.
Freeing unused kernel memory: 152k freed
Please be patient, while OpenWrt loads ...
- init -
init started:  BusyBox v1.4.2 (2019-07-15 15:17:41 CST) multi-call binary
Loading data from /dev/mtd3 ...

Done!

The data center is Running ...

mobiled deamon is running background...
board parameter in mtd7 and mtd2 partition are same and valid
The region number is: 0x0001
REGION: NA
PPP generic driver version 2.4.2
dni-lan-qos module init.
dni-qos module init.
NET: Registered protocol family 24
nf_nat_STARCRAFT: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
nf_conntrack_proto_esp loaded
NET: Registered protocol family 27
PPPoL2TP kernel driver, V0.16.1
PPTP-GRE-v1.13 2007 (C) Delta Networks Inc.
qca956x_GMAC: Length per segment 1536
956x_GMAC: qca956x_gmac_attach
956x_GMAC: qca956x_set_gmac_caps
Currently in interrupt mode unit0
qca956x_set_gmac_caps	CHECK DMA STATUS 
mac:0 Registering S17....
qca956x_GMAC: RX TASKLET - Pkts per Intr:160
qca956x_GMAC: Mac address for unit 0:bf1f0000
qca956x_GMAC: a0:04:60:15:b7:43 
qca956x_GMAC: Max segments per packet :   1
qca956x_GMAC: Max tx descriptor count :   128
qca956x_GMAC: Max rx descriptor count :   224
qca956x_GMAC: Mac capability flags    :   12002401
956x_GMAC: Serdes PLL is locked value 0x1b838116
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
Generating Rules...
Done!
SN: 3XB2695501006
WAN MAC: a0:04:60:15:B7:44
LAN MAC: a0:04:60:15:B7:43
WLA MAC: a0:04:60:15:B7:45
The region number is: 0x0001
REGION: NA
client bridge loaded
cp: cannot stat '/etc/wpa2.orig/*': No such file or directory
To set s17 LOOKUP_CTRL_REG registers, flag 0 
athr_gmac_ring_alloc Allocated 2048 at 0x870fb000
sram_desc_cnt 1536,mac Unit 0,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 3584 at 0x870e5000
sram_desc_cnt 4224,mac Unit 0,Rx r->ring_desc 0xbd000600
956x_GMAC: eth0 in SGMII MODE
Dragonfly  ----> S17 PHY *
******the ssdk init done value is : 0
athrs17_reg_init:done
955x_SGMII::athr_gmac_sgmii_setup  Done
Setting Drop CRC Errors, Pause Frames and Length Error frames 
Setting PHY...
Phy setup Complete
To set s17 LOOKUP_CTRL_REG registers, flag 1 
ADDRCONF(NETDEV_UP): phy0: link is not ready
athr_gmac_ring_free Freeing at 0x870fb000
athr_gmac_ring_free Freeing at 0x870e5000
Write Reg: 0x00000620: Oldval = 0x001004f0 Newval = 0x080004f0
Write Reg: 0x00000660: Oldval = 0x0014007e Newval = 0x0014017e
Write Reg: 0x0000066c: Oldval = 0x0014007d Newval = 0x0014017d
Write Reg: 0x00000678: Oldval = 0x0014007b Newval = 0x0014017b
Write Reg: 0x00000684: Oldval = 0x00140077 Newval = 0x00140177
Write Reg: 0x00000690: Oldval = 0x0014006f Newval = 0x0014016f
Write Reg: 0x0000069c: Oldval = 0x0014005f Newval = 0x0014015f
Write Reg: 0x00000c00: Oldval = 0x00000000 Newval = 0x00000002
Write Reg: 0x00000420: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x00000424: Oldval = 0x00003040 Newval = 0x00002040
Write Reg: 0x00000428: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x0000042c: Oldval = 0x00003040 Newval = 0x00001040
Write Reg: 0x00000430: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x00000434: Oldval = 0x00003040 Newval = 0x00001040
Write Reg: 0x00000438: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x0000043c: Oldval = 0x00003040 Newval = 0x00001040
Write Reg: 0x00000440: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x00000444: Oldval = 0x00003040 Newval = 0x00001040
Write Reg: 0x00000448: Oldval = 0x00010001 Newval = 0x00020001
Write Reg: 0x0000044c: Oldval = 0x00003040 Newval = 0x00001040
Write Reg: 0x00000614: Oldval = 0x00000000 Newval = 0x80000001
Write Reg: 0x00000610: Oldval = 0x00000000 Newval = 0x001bd560
Write Reg: 0x00000614: Oldval = 0x00000001 Newval = 0x80010002
Write Reg: 0x00000610: Oldval = 0x00000000 Newval = 0x001b7fe0
Write Reg: 0x00000614: Oldval = 0x00000002 Newval = 0x80020002
Write Reg: 0x00000624: Oldval = 0x007f7f7f Newval = 0x7f7f7f7f
Write Reg: 0x00000210: Oldval = 0x00000000 Newval = 0x06060606
Write Reg: 0x00000214: Oldval = 0x00000000 Newval = 0x01000006
Write Reg: 0x00000030: Oldval = 0x80000705 Newval = 0x80000302
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x5e7ffffa
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x00000100
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000001
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x00000001
Write Reg: 0x00000400: Oldval = 0x00000000 Newval = 0x80000020
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0xffffffff
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x0000ffff
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000fff
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x000000f9
Write Reg: 0x00000400: Oldval = 0x00000020 Newval = 0x80000120
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0xc0000000
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000013
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000400: Oldval = 0x00000120 Newval = 0x80000220
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x00003333
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000001
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x00000001
Write Reg: 0x00000400: Oldval = 0x00000220 Newval = 0x80000021
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x0000ffff
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000fff
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x000000f9
Write Reg: 0x00000400: Oldval = 0x00000021 Newval = 0x80000121
Write Reg: 0x00000404: Oldval = To set s17 LOOKUP_CTRL_REG registers, flag 0 
0x00000000 Newvaathr_gmac_ring_alloc Allocated 2048 at 0x871af000
l = 0x00000000
sram_desc_cnt 4224,mac Unit 0,Tx r->ring_desc 0xbd000000
Write Reg: 0x000athr_gmac_ring_alloc Allocated 3584 at 0x870e5000
00408: Oldval = sram_desc_cnt 4224,mac Unit 0,Rx r->ring_desc 0xbd000600
0x00000000 Newval = 0xc0000000
956x_GMAC: eth0 in SGMII MODE
Write Reg: 0x000Dragonfly  ----> S17 PHY *
0040c: Oldval = ******the ssdk init done value is : 1
0x00000000 Newval = 0x00000013
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
2

Here's the rest of the log that got cut off

Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000400: Oldval = 0x00000121 Newval = 0x80000221
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x00003333
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x0000001e
Write Reg: 0x00000400: Oldval = 0x00000221 Newval = 0x80000022
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x0000ffff
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x000000c9
Write Reg: 0x00000400: Oldval = 0x00000022 Newval = 0x80000122
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0xe0000000
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000013
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000400: Oldval = 0x00000122 Newval = 0x80000222
Write Reg: 0x00000404: Oldval = 0x00000000 Newva/proc/qca_switch/nf_athrs17_hnat is created
l = 0x00000000
/proc/qca_switch/nf_athrs17_hnat_wan_type is created
Write Reg: 0x000/proc/qca_switch/nf_athrs17_hnat_ppp_id is created
00408: Oldval = /proc/qca_switch/nf_athrs17_hnat_udp_thresh is created
0x00000000 Newva/proc/qca_switch/nf_athrs17_hnat_wan_ip is created
l = 0x00003333
/proc/qca_switch/nf_athrs17_hnat_ppp_peer_ip is created
Write Reg: 0x000/proc/qca_switch/nf_athrs17_hnat_ppp_peer_mac is created
0040c: Oldval = /proc/qca_switch/nf_athrs17_hnat_wan_mac is created
0x00000000 Newva/proc/qca_switch/nf_athrs17_hnat_ppp_id2 is created
l = 0x00000000
/proc/qca_switch/nf_athrs17_hnat_ppp_peer_mac is created
Write Reg: 0x000Adding ACL rules 15 - upnp_ssdp_add_acl_rules
00410: Oldval = 0x00000000 Newval = 0x00000002
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x00000001
Write Reg: 0x00000400: Oldval = 0x00000222 Newval = 0x80000023
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x0000ffff
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
Adding ACL rules 8 - ipv6_snooping_solicted_node_add_acl_rules
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x000000f9
Write Reg: 0x00000400: Oldval = 0x00000023 Newval = 0x80000123
Write Reg: 0x00000404: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000408: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x0000040c: Oldval = 0x00000000 Newval = 0x00000014
Write Reg: 0x00000410: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000414: Oldval = 0x00000000 Newval = 0x00000000
Write Reg: 0x00000400: Oldval = 0x00000123 Newval = 0x80000223
Adding ACL rules 12 - ipv6_snooping_sextuple0_group_add_acl_rules
Adding ACL rules 14 - ipv6_snooping_quintruple0_1_group_add_acl_rules
Hello, nat helper module for 1.1!

######## S17 SSDK init succeeded! ########
Error: cannot be initialized twice!
athrs17_reg_init:done
955x_SGMII::athr_gmac_sgmii_setup  Done
Setting Drop CRC Errors, Pause Frames and Length Error frames 
Setting PHY...
Phy setup Complete
To set s17 LOOKUP_CTRL_REG registers, flag 1 
ADDRCONF(NETDEV_UP): phy0: link is not ready
init.enet: Default WAN MAC is : a0:04:60:15:b7:44
device eth0 entered promiscuous mode
device phy0 entered promiscuous mode
init.enet: Default LAN MAC is : a0:04:60:15:b7:43
Loading DNI-ENET driver
device pas0 entered promiscuous mode

Enet:0 port3 up
956x_GMAC: Enet Unit:0 PHY:3 is UP eth0 SGMII 1000Mbps full duplex
956x_GMAC: done cfg2 0x7235 ifctl 0x0 miictrl  
955x_SGMII::athr_gmac_sgmii_setup  Done
Setting Drop CRC Errors, Pause Frames and Length Error frames 
ADDRCONF(NETDEV_CHANGE): phy0: link becomes ready
br0: port 1(eth0) entering forwarding state
br0: port 1(eth0) entering disabled state
br0: port 1(eth0) entering forwarding state

 SSDK Init OK!
operate done.

udhcp server (v0.9.8) started

Enet:0 port:3 down
956x_GMAC:unit 0: phy 3 not up carrier 1
br0: port 1(eth0) entering disabled state
The attached devices demo is Running ...
The telnetenable is running ...
Deleting static route ... Done!
Adding static route ... Done!
usbcore: deregistering interface driver usbserial_generic
USB Serial deregistering driver generic
usbcore: deregistering interface driver usbserial
rmmod: cdc_ncm: No such file or directory
killall: failover: no process killed
rmmod: usbserial: No such file or directory
rmmod: usbserial: No such file or directory
dni-qos attached on eth1.
dni-qos attached on br0.
udhcp client (v0.9.8) started
time zone index is : 21
Run NTP Client with setting: pri:time-b.netgear.com sec:time-c.netgear.com
no 6RD parameters available, so unset 6rd related config
killall: miniupnpd: no process killed
killall: pppd: no process killed

Enet:0 port3 up
956x_GMAC: Enet Unit:0 PHY:3 is UP eth0 SGMII 1000Mbps full duplex
956x_GMAC: done cfg2 0x7235 ifctl 0x0 miictrl  
955x_SGMII::athr_gmac_sgmii_setup  Done
Setting Drop CRC Errors, Pause Frames and Length Error frames 
br0: port 1(eth0) entering forwarding state
Deleting static route ... Done!
Deleting static route ... Done!
Adding static route ... Done!
Jan  1 00:00:28 miniupnpd[1047]: listening on 192.168.1.1:5555
start rip process
start initial data
Sending discover...
No user name for DDNS!
syslogd can't open the temp log file: /tmp/log/log-message or /var/log/messages
Starting Firewall...
Done!
The region number is: 0x0001
REGION: NA
Generating RSA private key, 1024 bit long modulus
ufsd:: trace mask set to 0000000f
ufsd: driver (lke_9.0.0 lke_9.0.0_r233352_b3, LBD=ON, acl, ioctl, bdi, sd(0), wb, bz, tr) loaded at 87380000
NTFS support included
Big endian platform
optimized: speed
Build_for__NETGEAR_WNDR4500V3_k2.6.31_2014-06-18_lke_9.0.0_r233352_b3

kcg 354 :GPL NetUSB up!
INFO1A45: NetUSB 1.10.12, 0002061F : Jul 12 2019 14:03:38
INFO1A47: 7423: WNDR4500v3 :WNDR4500v3 
INFO1A48:  AUTH ISOC
INFO1A49:  MOVE_HEAD emb_lp filterAudio
INFO0789:  0 : tunnelID emusblp 0 
INFO0789:  1 : tunnelID emusblp 1 
INFO0789:  2 : tunnelID emusblp 2 
INFO0789:  3 : tunnelID emusblp 3 
INFO0789:  4 : tunnelID emusblp 4 
INFO0789:  5 : tunnelID emusblp 5 
INFO0789:  6 : tunnelID emusblp 6 
INFO0789:  7 : tunnelID emusblp 7 
INFO0789:  8 : tunnelID emusblp 8 
INFO0789:  9 : tunnelID emusblp 9 
usbcore: registered new interface driver KC NetUSB General Driver
INFO0B43:  --- checkSBusTimeoutThread start ---
INFO019C:  init proc : PAGE_SIZE 4096
INFO193A:  infomap 87307ac8 
INFO193E:  bndev : br0 
INFO1943:  sleep to wait br0 to wake up
INFO173B: tcpConnector() started... : br0 
Changing password for admin
New password:Sending discover...

Bad password: too weak
Retype password:Generating selfsigned certificate with subject 'C=DE;ST=Saxony;L=Leipzig;CN=OpenWrt;' and validity 2001-09-09 01:46:40-2003-09-09 01:46:40
AUTO FW CHECK: power cycle

Password for admin changed by root
killall: smbd: no process killed
killall: smbd: no process killed
killall: nmbd: no process killed
/etc/rc.common: /etc/rc.common: 117: detplc: not found
USB Storage daemon is Running ... 
FW checking ...
POT is Running...
POT is Finished!!!
The POT-(Get/Set) Demo is Running ...
week_day == 3
Changing password for admin
New password:ADDRCONF(NETDEV_UP): sit0: link is not ready
ADDRCONF(NETDEV_UP): pas0: link is not ready
killall: daemonv6: no process killed
cat: /tmp/ipv6_auto_output: No such file or directory
Sorry, rule does not exist.
Sorry, rule does not exist.
DHCPv6 client is not running! Return
Disabling IPv6RD Tunneling..
ifconfig: ppp0: error fetching interface information: Device not found
Stop 6autodetrm: cannot remove '/tmp/ipv6_auto_output': No such file or directory

Bad password: too weak
Retype password:DHCPv6 client is not running! Return
killall: radvd: no process killed
killall: dhcp6s: no process killed
Shutting down zebra: Terminated
Shutting down ripngd: Terminated
RTNETLINK answers: No such process
RTNETLINK answers: Invalid argument
RTNETLINK answers: No such process
RTNETLINK answers: Invalid argument
RTNETLINK answers: No such file or directory
Stopping Firewall...
IPv6 Done!
killall: 6pppoe: no process killed

Password for admin changed by root
[USB-AFP]: Total 0 partitions are FOUND!
killall: avahi-daemon: no process killed
[USB-AFP]: Loading USB share information ......diskname: (null)
cat: /var/run/afpd.pid: No such file or directory
the ipv6 wan type is disable
Sending discover...
Args: 1
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_tx99: Version 2.0
Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2-00085-8 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=540
Enterprise mode: 0x03bda000
Restoring Cal data from Flash
Green-AP : Green-AP : Attached

ath_get_caps[6148] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6123] tx chainmask mismatch actual 3 sc_chainmak 0
ath_attach_dfs[12558] dfsdomain 1
ath_tx_paprd_init sc 870d0000 PAPRD disabled in HAL
SC Callback Registration for wifi0
wifi0: Atheros 956X: mem=0xb8100000, irq=2
ath_pci: 10.2-00085-8 (Atheros/multi-bss)
__ath_attach: Set global_scn[1]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=540
Restoring Cal data from Flash
Green-AP : Green-AP : Attached

ath_get_caps[6148] rx chainmask mismatch actual 7 sc_chainmak 0
ath_get_caps[6123] tx chainmask mismatch actual 7 sc_chainmak 0
ath_attach_dfs[12558] dfsdomain 1
ath_tx_paprd_init sc 87060000 PAPRD disabled in HAL
SC Callback Registration for wifi1
wifi1: Atheros ???: mem=0x12000000, irq=76 hw_base=0xb2000000
ath_attach_dfs[12558] dfsdomain 1
ath_attach_dfs[12558] dfsdomain 1
Creating ap for NETGEAR12 on
wlan_vap_create : enter. devhandle=0x866d02c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x866d02c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created 
Added ath0 mode master
Invalid command : bgscan
Interface doesn't accept private ioctl...
HALDbg (8BE0): Operation not permitted
Interface doesn't accept private ioctl...
ForBiasAuto (8BE0): Operation not permitted
 
 DES SSID SET=NETGEAR12 
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
Set freq vap stop send + 85474000
Set freq vap stop send -85474000
Set wait done --85474000
/etc/ath/makeVAP: /etc/ath/makeVAP: 492: cannot create /proc/sys/dev/ath/htdupieenable: Directory nonexistent
WARNING: Fragmentation with HT mode NOT ALLOWED!!
Error for wireless request "Set Fragmentation Threshold" (8B24) :
    SET failed on device ath0 ; Invalid argument.
Invalid command : setVowExt
Invalid command : setKeySrchAlways
Invalid command : set_vsp_enable
Invalid command : setPhyRestartWar
Invalid command : setVowExtStats
sc nodebug 0 
Created ath0 mode ap for NETGEAR12
lo        no wireless extensions.

sit0      no wireless extensions.

phy0      no wireless extensions.

br0       no wireless extensions.

eth0      no wireless extensions.

eth1      no wireless extensions.

pas0      no wireless extensions.

wifi0     no wireless extensions.

wifi1     no wireless extensions.

Modules already loaded
Creating ap for NETGEAR12-5G on
wlan_vap_create : enter. devhandle=0x85bc02c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x85bc02c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath1 created 
Added ath1 mode master
Invalid command : bgscan
Interface doesn't accept private ioctl...
HALDbg (8BE0): Operation not permitted
Invalid command : extoffset
 
 DES SSID SET=NETGEAR12-5G 
 ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1 
Set freq vap stop send + 85478000
Set freq vap stop send -85478000
Set wait done --85478000
/etc/ath/makeVAP: /etc/ath/makeVAP: 492: cannot create /proc/sys/dev/ath/htdupieenable: Directory nonexistent
WARNING: Fragmentation with HT mode NOT ALLOWED!!
Error for wireless request "Set Fragmentation Threshold" (8B24) :
    SET failed on device ath1 ; Invalid argument.
Invalid command : setVowExt
Invalid command : setKeySrchAlways
Invalid command : set_vsp_enable
Invalid command : setPhyRestartWar
Invalid command : setVowExtStats
sc nodebug 0 
Created ath1 mode ap for NETGEAR12-5G
lo        no wireless extensions.

sit0      no wireless extensions.

phy0      no wireless extensions.

br0       no wireless extensions.

eth0      no wireless extensions.

eth1      no wireless extensions.

pas0      no wireless extensions.

wifi0     no wireless extensions.

wifi1     no wireless extensions.

lo        no wireless extensions.

sit0      no wireless extensions.

phy0      no wireless extensions.

br0       no wireless extensions.

eth0      no wireless extensions.

eth1      no wireless extensions.

pas0      no wireless extensions.
device ath0 entered promiscuous mode

wifi0     no wireless extensions.

wifi1     no wireless extensions.

arping: bind: Cannot assign requested address
>>>>> WPS MODE, 2
>>>>> WPS ENABLED, PSK
cat: /etc/wpa2/WSC_ath0.conf: No such file or directory
>>>>> WPS Translate, Index:0
No lease, forking to background.
lo        no wireless extensions.

sit0      no wireless extensions.

phy0      no wireless extensions.

br0       no wireless extensions.

eth0      no wireless extensions.

eth1      no wireless extensions.

pas0      no wireless extensions.
device ath1 entered promiscuous mode

wifi0     no wireless extensions.

wifi1     no wireless extensions.

arping: bind: Cannot assign requested address
>>>>> WPS MODE, 2
>>>>> WPS ENABLED, PSK
cat: /etc/wpa2/WSC_ath1.conf: No such file or directory
>>>>> WPS Translate, Index:2
Configuration fi ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
le: /etc/wpa2/WS DEVICE IS DOWN ifname=ath0
C_ath0.conf
 DEVICE IS DOWN ifname=ath0
ath0: Could not connect to kernel driver
Using interface ath0 with hwaddr a0:04:60:15:b7:43 and ssid 'NETGEAR12'
br0: port 3(ath0) entering forwarding state
Configuration fi ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1 
le: /etc/wpa2/WS DEVICE IS DOWN ifname=ath1
C_ath1.conf
 DEVICE IS DOWN ifname=ath1
ath1: Could not connect to kernel driver
Using interface ath1 with hwaddr a0:04:60:15:b7:45 and ssid 'NETGEAR12-5G'
br0: port 4(ath1) entering forwarding state
traffic_meter start : .
killall: igmpproxy: no process killed
mtdoops: Attached to MTD device 13 name mtdoops
Boot up procedure is Finished!!!

Please press Enter to activate this console. mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
Sending discover...



BusyBox v1.4.2 (2019-07-15 15:17:41 CST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r18571) ------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@WNDR4300v2:/# uname -a
Linux WNDR4300v2 2.6.31 #1 Mon Jul 15 15:43:25 CST 2019 mips unknown
root@WNDR4300v2:/# Sending discover...
Sending discover...
3

That looks like the OEM firmware. It is based on a really ancient OpenWrt version, and naturally uses a matching kernel.

Kamikaze is roughly the year 2009 version (with kernel 2.6.31).

What makes you to think that you are not running the OEM stock firmware? The log items pretty much point toward proprietary OEM add-ons.

Most OEM firmwares are based on OpenWrt, and some even carry the banner files etc...

You might need to use the OEM firmware to reset it's own settings, and you might need to reflash it again so that it can adjust its own settings (assuming that the OEM flash process has some variations from the current OpenWrt).

You might also need to switch browser, or at least clear browser cache. Cache sometimes causes trouble.

4

Yes, turns out it was the browser cache the whole time. I should have suspected something like that earlier, but I suppose seeing the OpenWRT banner was just something I didn't expect at all, so I assumed that maybe something was being left behind somehow. Thanks so much for your help!