ZTE mf286d no boot after sysupgrade + CPU problems

Skimmed it, but saw the bootcmd in the forum link, though it was worth trying.

Thank you, here are the images I tried. So, the one that worked for almost a year without issues is the one linked in the OpenWRT page dedicated to this hardware here https://openwrt.org/toh/zte/mf286d, version 23.5.2: https://openwrt.org/releases/23.05.2 after the last week crashes I tried flashing the new 23.5.3 found here: https://firmware-selector.openwrt.org/ more precisely here https://firmware-selector.openwrt.org/?version=23.05.3&target=ipq40xx%2Fgeneric&id=zte_mf286d . Sometimes the modem crashes during sysupgrade upload (around 48% in luci after initramfs via serial port). I tried also going back with the 23.5.2, and also the eko.one here https://dl.eko.one.pl/luci/openwrt-23.05/ipq40xx/generic/luci-23.05-snapshot-r23851-eda76b336b-ipq40xx-generic-zte_mf286d-initramfs-zImage.itb and here https://dl.eko.one.pl/luci/openwrt-23.05/ipq40xx/generic/luci-23.05-snapshot-r23851-eda76b336b-ipq40xx-generic-zte_mf286d-squashfs-sysupgrade.bin and the gargoyle too here https://dl.eko.one.pl/gargoyle-pl/1.14/targets/ipq40xx/generic/gargoyle-1.14.0.3-zte_mf286d-initramfs-fit-zImage.itb

all of them besides the crashes, upload normally, Just a note, if I upload the initramfs without doing sysupgrade, the initramfs is wiped at reboot too.

these are the commands I gave to flash the initramfs:

nand erase 0x1800000 0x1d00000
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
set fdt_high 0x85000000
saveenv
tftp root_uImage (initramfs renamed)
bootm $loadaddr

please erase the UBI partition from within initramfs, before sysupgrade

@Leo-PL is it done with the nand erase I gave above or have I to issue a different command?

I just tired to install this one here https://downloads.openwrt.org/releases/23.05.2/targets/ipq40xx/generic/openwrt-23.05.2-ipq40xx-generic-zte_mf286d-initramfs-zImage.itb

and got this... :astonished:

(IPQ40xx) # bootm $loadaddr
## Booting kernel from FIT Image at 84000000 ...
   Using 'config@ap.dk04.1-c1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM OpenWrt Linux-5.15.137
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x840000e4
     Data Size:    6612704 Bytes = 6.3 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   838ffac3
     Hash algo:    sha1
     Hash value:   60f6c9c1abd236156152f3bcda8166857c762330
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 84000000
   Using 'config@ap.dk04.1-c1' configuration
   Trying 'fdt-1' FDT blob subimage
     Description:  ARM OpenWrt zte_mf286d device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8464e8f8
     Data Size:    19105 Bytes = 18.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   40fdc7b4
     Hash algo:    sha1
     Hash value:   1992cbaae5ebb80f2739e73ef7e793d6b34d7033
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x8464e8f8
   Loading Kernel Image ... OK
OK
   Loading Device Tree to 84ff8000, end 84fffaa0 ... OK
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
Using machid 0x8010001 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.15.137 (builder@buildhost) (arm-openwrt-linux-mus                      lgnueabi-gcc (OpenWrt GCC 12.3.0 r23630-842932a63d) 12.3.0, GNU ld (GNU Binutils                      ) 2.40.0) #0 SMP Tue Nov 14 13:38:11 2023
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instructio                      n cache
[    0.000000] OF: fdt: Machine model: ZTE MF286D
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000080000000-0x000000008fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000080000000-0x0000000087dfffff]
[    0.000000]   node   0: [mem 0x0000000087e00000-0x0000000087ffffff]
[    0.000000]   node   0: [mem 0x0000000088000000-0x000000008fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x000000008fffffff]
[    0.000000] percpu: Embedded 12 pages/cpu s16588 r8192 d24372 u49152
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64960
[    0.000000] Kernel command line: ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstyp                      e=squashfs rootwait ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootw                      ait ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait root=/dev/ub                      iblock0_1
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, l                      inear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, lin                      ear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 234912K/262144K available (6746K kernel code, 610K rwdata                      , 1020K rodata, 13312K init, 247K bss, 27232K reserved, 0K cma-reserved, 0K high                      mem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jif                      fies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles:                       0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000001] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 43980                      46511096ns
[    0.000023] Switching to timer-based delay loop, resolution 20ns
[    0.000326] Calibrating delay loop (skipped), value calculated using timer fr                      equency.. 96.00 BogoMIPS (lpj=480000)
[    0.000353] CPU: Testing write buffer coherency: ok
[    0.000405] pid_max: default: 32768 minimum: 301
[    0.001254] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linea                      r)
[    0.001283] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes,                       linear)
[    0.003230] qcom_scm: convention: smc legacy
[    0.004420] Setting up static identity map for 0x80300000 - 0x8030003c
[    0.004593] rcu: Hierarchical SRCU implementation.
[    0.005175] smp: Bringing up secondary CPUs ...
[    0.008580] smp: Brought up 1 node, 4 CPUs
[    0.008615] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.008631] CPU: All CPU(s) started in SVC mode.
[    0.015288] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7                       rev 5
[    0.015451] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma                      x_idle_ns: 19112604462750000 ns
[    0.015486] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.015846] pinctrl core: initialized pinctrl subsystem
[    0.017871] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.018338] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.019652] thermal_sys: Registered thermal governor 'step_wise'
[    0.020133] cpuidle: using governor ladder
[    0.020195] cpuidle: using governor menu
[    0.049327] cryptd: max_cpu_qlen set to 1000
[    0.053996] usbcore: registered new interface driver usbfs
[    0.054075] usbcore: registered new interface driver hub
[    0.054137] usbcore: registered new device driver usb
[    0.054226] pps_core: LinuxPPS API ver. 1 registered
[    0.054241] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giome                      tti <giometti@linux.it>
[    0.054271] PTP clock support registered
[    0.056520] clocksource: Switched to clocksource arch_sys_counter
[    0.058029] NET: Registered PF_INET protocol family
[    0.058257] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear                      )
[    0.059226] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144                       bytes, linear)
[    0.059282] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes,                       linear)
[    0.059307] TCP established hash table entries: 2048 (order: 1, 8192 bytes, l                      inear)
[    0.059349] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.059404] TCP: Hash tables configured (established 2048 bind 2048)
[    0.059549] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.059595] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.059920] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.059974] PCI: CLS 0 bytes, default 64
[    0.062530] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.068834] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.068870] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT                      Y) (c) 2001-2006 Red Hat, Inc.
[    0.202225] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2                      48)
[    0.207177] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    0.207212] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    0.208760] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.208874] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[    0.209011] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.209138] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.209469] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.211517] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.211572] msm_serial 78af000.serial: uartclk = 1843200
[    0.211629] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 33, base_baud =                       115200) is a MSM
[    0.211667] msm_serial: console setup on port #0
[    0.774101] printk: console [ttyMSM0] enabled
[    0.779221] msm_serial: driver initialized
[    0.789053] loop: module loaded
[    0.790750] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xf1
[    0.791013] nand: Micron MT29F1G08ABAEAWP
[    0.797669] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB siz                      e: 64
[    0.801640] 12 fixed-partitions partitions found on MTD device qcom_nand.0
[    0.809037] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partit                      ions
[    0.815862] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partit                      ions
[    0.823860] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partit                      ions
[    0.830912] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partit                      ions
[    0.838889] Creating 12 MTD partitions on "qcom_nand.0":
[    0.845787] 0x000000000000-0x0000000a0000 : "fota-flag"
[    0.852855] 0x0000000a0000-0x000000120000 : "ART"
[    0.857582] 0x000000120000-0x0000001a0000 : "mac"
[    0.862399] 0x0000001a0000-0x000000260000 : "reserved2"
[    0.867468] 0x000000260000-0x000000660000 : "cfg-param"
[    0.877442] 0x000000660000-0x000000a60000 : "log"
[    0.884307] 0x000000a60000-0x000000b00000 : "oops"
[    0.885904] 0x000000b00000-0x000001000000 : "reserved3"
[    0.896467] 0x000001000000-0x000001800000 : "web"
[    0.909583] 0x000001800000-0x000003500000 : "rootfs"
[    0.955373] mtd: setting mtd9 (rootfs) as root device
[    0.956049] mtdsplit: no squashfs found in "rootfs"
[    0.959470] 0x000003500000-0x000004e00000 : "data"
[    1.003627] 0x000004e00000-0x000008000000 : "fota"
[    1.087858] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.089497] spi-nor spi0.0: gd25q16 (2048 Kbytes)
[    1.094043] 8 fixed-partitions partitions found on MTD device spi0.0
[    1.098649] Creating 8 MTD partitions on "spi0.0":
[    1.105020] 0x000000000000-0x000000040000 : "0:SBL1"
[    1.110255] 0x000000040000-0x000000060000 : "0:MIBIB"
[    1.115257] 0x000000060000-0x0000000c0000 : "0:QSEE"
[    1.120433] 0x0000000c0000-0x0000000d0000 : "0:CDT"
[    1.125300] 0x0000000d0000-0x0000000e0000 : "0:DDRPARAMS"
[    1.129950] 0x0000000e0000-0x0000000f0000 : "0:APPSBLENV"
[    1.135471] 0x0000000f0000-0x0000001b0000 : "0:APPSBL"
[    1.140986] 0x0000001b0000-0x000000200000 : "0:reserved1"
[    1.259762] i2c_dev: i2c /dev entries driver
[    1.261960] sdhci: Secure Digital Host Controller Interface driver
[    1.263112] sdhci: Copyright(c) Pierre Ossman
[    1.269138] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.277609] NET: Registered PF_INET6 protocol family
[    1.280962] Segment Routing with IPv6
[    1.284266] In-situ OAM (IOAM) with IPv6
[    1.287928] NET: Registered PF_PACKET protocol family
[    1.291821] bridge: filtering via arp/ip/ip6tables is no longer available by                       default. Update your scripts to load br_netfilter if you need this.
[    1.297114] 8021q: 802.1Q VLAN Support v1.8
[    1.309956] Registering SWP/SWPB emulation handler
[    1.344763] qca8k-ipq4019 c000000.switch: configuring for fixed/internal link                       mode
[    1.345093] qca8k-ipq4019 c000000.switch: Link is Up - 1Gbps/Full - flow cont                      rol rx/tx
[    1.429833] qca8k-ipq4019 c000000.switch lan4 (uninitialized): PHY [90000.mdi                      o-1:01] driver [Qualcomm QCA8075] (irq=POLL)
[    1.509729] qca8k-ipq4019 c000000.switch lan3 (uninitialized): PHY [90000.mdi                      o-1:02] driver [Qualcomm QCA8075] (irq=POLL)
[    1.589780] qca8k-ipq4019 c000000.switch lan2 (uninitialized): PHY [90000.mdi                      o-1:03] driver [Qualcomm QCA8075] (irq=POLL)
[    1.671161] qca8k-ipq4019 c000000.switch wan (uninitialized): PHY [90000.mdio                      -1:04] driver [Qualcomm QCA8075] (irq=POLL)
[    1.672111] DSA: tree 0 setup
[    1.681738] ubi0: attaching mtd9
[    1.863504] ubi0: scanning is finished
[    1.863545] ubi0: empty MTD device detected
[    1.886915] ubi0: attached mtd9 (name "rootfs", size 29 MiB)
[    1.886965] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.891661] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.898379] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.905201] ubi0: good PEBs: 232, bad PEBs: 0, corrupted PEBs: 0
[    1.911996] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 12                      8
[    1.918239] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequ                      ence number: 999954581
[    1.925258] ubi0: available PEBs: 208, total reserved PEBs: 24, PEBs reserved                       for bad PEB handling: 20
[    1.934232] ubi: mtd9 is already attached to ubi0
[    1.934233] ubi0: background thread "ubi_bgt0d" started, PID 133
[    1.943595] UBI error: cannot attach mtd9
[    1.943607] ubi: mtd9 is already attached to ubi0
[  ▒[    1.988940] Freeing unused kernel image (initmem) memory: 13312K
[    1.989290] Run /init as init process
[    2.451132] init: Console is alive
[    2.451519] init: - watchdog -
[    2.463151] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.835108] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    2.835190] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus nu                      mber 1
[    2.839795] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f665 hci version 0x100                       quirks 0x0000000002010010
[    2.847202] xhci-hcd xhci-hcd.0.auto: irq 104, io mem 0x08a00000
[    2.856645] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    2.862701] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus nu                      mber 2
[    2.868010] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
[    2.876284] hub 1-0:1.0: USB hub found
[    2.882204] hub 1-0:1.0: 1 port detected
[    2.886346] usb usb2: We don't know the algorithms for LPM for this host, dis                      abling LPM.
[    2.893295] hub 2-0:1.0: USB hub found
[    2.898089] hub 2-0:1.0: 1 port detected
[    2.902195] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    2.905678] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus nu                      mber 3
[    2.911253] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220f665 hci version 0x100                       quirks 0x0000000002010010
[    2.918594] xhci-hcd xhci-hcd.1.auto: irq 105, io mem 0x06000000
[    2.928058] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    2.934141] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus nu                      mber 4
[    2.939453] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    2.947756] hub 3-0:1.0: USB hub found
[    2.953615] hub 3-0:1.0: 1 port detected
[    2.957805] usb usb4: We don't know the algorithms for LPM for this host, dis                      abling LPM.
[    2.961995] hub 4-0:1.0: USB hub found
[    2.970791] hub 4-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    2.975363] kmodloader: done loading kernel modules from /etc/modules-boot.d/                      *
[    2.988720] init: - preinit -
[    3.166222] random: jshn: uninitialized urandom read (4 bytes read)
[    3.211698] random: jshn: uninitialized urandom read (4 bytes read)
[    3.239471] random: jshn: uninitialized urandom read (4 bytes read)
[    3.462231] ipqess-edma c080000.ethernet eth0: configuring for fixed/internal                       link mode
[    3.462969] qca8k-ipq4019 c000000.switch lan2: configuring for phy/psgmii lin                      k mode
[    3.469494] ipqess-edma c080000.ethernet eth0: Link is Up - 1Gbps/Full - flow                       control rx/tx
[    4.166790] usb 2-1: new SuperSpeed USB device number 2 using xhci-hcd
[    4.199566] random: procd: uninitialized urandom read (4 bytes read)
[    4.386017] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.506279] procd: - early -
[    6.506552] procd: - watchdog -
[    7.067702] procd: - watchdog -
[    7.068198] procd: - ubus -
[    7.075686] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.120213] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.120618] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.128318] procd: - init -
Please press Enter to activate this console.
[    7.438087] kmodloader: loading kernel modules from /etc/modules.d/*
[    7.447760] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[    7.447813] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[    7.546565] PPP generic driver version 2.4.2
[    7.548357] NET: Registered PF_PPPOX protocol family
[    8.258453] urngd: v1.0.2 started.
[    8.355034] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[    8.355102] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[    8.366975] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[    8.422802] ath10k_ahb a000000.wifi: Loading BDF type 0
[    8.438812] ath10k_ahb a000000.wifi: board_file api 2 bmi_id 0:20 crc32 d140cd7d
[    8.787011] random: crng init done
[    8.787057] random: 29 urandom warning(s) missed due to ratelimiting
[    9.734033] ath10k_ahb a000000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[    9.734100] ath10k_ahb a000000.wifi: msdu-desc: 2500  skid: 32
[    9.782725] ath10k_ahb a000000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[    9.783679] ath10k_ahb a000000.wifi: wmi print 'free: 53252 iram: 13432 sram: 35752'
[    9.923625] ath10k_ahb a000000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1
[   10.855651] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   10.855718] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   10.867661] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   10.922668] ath10k_ahb a800000.wifi: Loading BDF type 0
[   10.934659] ath10k_ahb a800000.wifi: board_file api 2 bmi_id 0:21 crc32 d140cd7d
[   12.226206] ath10k_ahb a800000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   12.226279] ath10k_ahb a800000.wifi: msdu-desc: 2500  skid: 32
[   12.273336] ath10k_ahb a800000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   12.274280] ath10k_ahb a800000.wifi: wmi print 'free: 53252 iram: 13432 sram: 35752'
[   12.409898] ath10k_ahb a800000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1
[   12.531256] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.878879] 8<--- cut here ---
[   12.878944] Unhandled fault: external abort on non-linefetch (0x1008) at 0xc7d49f50
[   12.880876] pgd = 547260c3
[   12.888416] [c7d49f50] *pgd=87c1141e(bad)
[   12.891193] Internal error: : 1008 [#1] SMP ARM
[   12.895277] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet ath10k_pci ath10k_core ath pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211 cfg80211 slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c hwmon crc_ccitt compat sha512_arm ghash_arm_ce cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom gpio_button_hotplug crc32c_generic
[   12.938151] CPU: 1 PID: 584 Comm: hotplug-call Not tainted 5.15.137 #0
[   12.960385] Hardware name: Generic DT based system
[   12.966980] PC is at 0xc06095a0
[   12.971742] LR is at 0x6ffffffa
[   12.974786] pc : [<c06095a0>]    lr : [<6ffffffa>]    psr: 20000113
[   12.977919] sp : c2ea7e98  ip : 00000001  fp : 00000255
[   12.984166] r10: 00000800  r9 : c30b3ea0  r8 : c0312794
[   12.989376] r7 : cfed1290  r6 : c7c84000  r5 : c7d49000  r4 : 6ffffffb
[   12.994584] r3 : 00000000  r2 : 00000001  r1 : c7d49f50  r0 : c7c84f50
[   13.001176] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   13.007701] Control: 10c5387d  Table: 830b406a  DAC: 00000051
[   13.014895] Register r0 information: non-slab/vmalloc memory
[   13.020627] Register r1 information: non-slab/vmalloc memory
[   13.026354] Register r2 information: non-paged memory
[   13.031989] Register r3 information: NULL pointer
[   13.036936] Register r4 information: non-paged memory
[   13.041624] Register r5 information: non-slab/vmalloc memory
[   13.046660] Register r6 information: non-slab/vmalloc memory
[   13.052396] Register r7 information: non-slab/vmalloc memory
[   13.058038] Register r8 information: non-slab/vmalloc memory
[   13.063681] Register r9 information: slab vm_area_struct start c30b3ea0 pointer offset 0
[   13.069329] Register r10 information: non-paged memory
[   13.077395] Register r11 information: non-paged memory
[   13.082344] Register r12 information: non-paged memory
[   13.087464] Process hotplug-call (pid: 584, stack limit = 0x7b4534ca)
[   13.092587] Stack: (0xc2ea7e98 to 0xc2ea8000)
[   13.099103] 7e80:                                                       ffffe000 c031280c
[   13.103460] 7ea0: c2ea7f04 cfed1290 cfed2e44 c30b3ea0 c0312794 c0441514 c386ea7c 00000030
[   13.111638] 7ec0: 00300000 c3a93200 87cfe7df c1f691e0 00000001 c30b3ea0 c2ea6000 00000255
[   13.119779] 7ee0: 00000c73 c1876344 00000040 00000800 00000255 c0445d8c 00000000 c0457c34
[   13.127938] 7f00: 80000013 c30b3ea0 01100cca 00000073 b6fbc000 00000255 c30b6db8 c30b6db8
[   13.136099] 7f20: 87d497dd 00000000 cfed2e44 c2b546f0 cfe1a7e4 00000000 c099bab0 c2ea7fb0
[   13.144264] 7f40: b6fbc204 00000817 c3a93200 c30b3ea0 c3a93240 00000800 00000255 c030e168
[   13.152418] 7f60: c030e060 00000817 b6fbc204 c2ea7fb0 c1809a40 10c5387d b6f3552c 000786f4
[   13.160577] 7f80: b6f35cb4 c030e4a8 00000000 00000000 00000000 00000000 00032ef8 60000010
[   13.168738] 7fa0: ffffffff 10c5387d 10c5387d c0300e1c b6fbcac0 b6f3558c 00000000 b6fbc020
[   13.176881] 7fc0: b6fbcac0 00000000 00000000 b6f3558c 00000000 b6f3552c 000786f4 b6f35cb4
[   13.185070] 7fe0: 00000001 be8d4870 b6f8739c 00032ef8 60000010 ffffffff 00000000 00000000
[   13.193220] Code: e8b15018 e8a05018 e8b15018 e8a05018 (e8b15018)
[   13.201362] ---[ end trace 8b811f1fd0baef4b ]---
[   13.207434] Kernel panic - not syncing: Fatal exception
[   13.212118] CPU2: stopping
[   13.217058] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G      D           5.15.137 #0
[   13.219842] Hardware name: Generic DT based system
[   13.227397] Function entered at [<c030d3a8>] from [<c0309784>]
[   13.232079] Function entered at [<c0309784>] from [<c060cd44>]
[   13.237895] Function entered at [<c060cd44>] from [<c030bf40>]
[   13.243712] Function entered at [<c030bf40>] from [<c030bf8c>]
[   13.249525] Function entered at [<c030bf8c>] from [<c03763b4>]
[   13.255344] Function entered at [<c03763b4>] from [<c0370588>]
[   13.261159] Function entered at [<c0370588>] from [<c0625194>]
[   13.266976] Function entered at [<c0625194>] from [<c0300b3c>]
[   13.272791] Exception stack(0xc1c73f58 to 0xc1c73fa0)
[   13.278608] 3f40:                                                       000024ca 00000000
[   13.283737] 3f60: 00000001 c0312e60 00000002 c1804f28 c1c72000 00000000 00000000 ffffe000
[   13.291897] 3f80: 00000000 c1804f5c c18bef40 c1c73fa8 c0306fdc c0306fe0 60000013 ffffffff
[   13.300052] Function entered at [<c0300b3c>] from [<c0306fe0>]
[   13.308207] Function entered at [<c0306fe0>] from [<c0351804>]
[   13.313938] Function entered at [<c0351804>] from [<c0351b68>]
[   13.319751] Function entered at [<c0351b68>] from [<80301510>]
[   13.325570] CPU3: stopping
[   13.331380] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G      D           5.15.137 #0
[   13.334077] Hardware name: Generic DT based system
[   13.341627] Function entered at [<c030d3a8>] from [<c0309784>]
[   13.346313] Function entered at [<c0309784>] from [<c060cd44>]
[   13.352130] Function entered at [<c060cd44>] from [<c030bf40>]
[   13.357945] Function entered at [<c030bf40>] from [<c030bf8c>]
[   13.363761] Function entered at [<c030bf8c>] from [<c03763b4>]
[   13.369578] Function entered at [<c03763b4>] from [<c0370588>]
[   13.375394] Function entered at [<c0370588>] from [<c0625194>]
[   13.381210] Function entered at [<c0625194>] from [<c0300b3c>]
[   13.387025] Exception stack(0xc1c75f58 to 0xc1c75fa0)
[   13.392843] 5f40:                                                       0000453c 00000000
[   13.397973] 5f60: 00000001 c0312e60 00000003 c1804f28 c1c74000 00000000 00000000 ffffe000
[   13.406134] 5f80: 00000000 c1804f5c c18bef40 c1c75fa8 c0306fdc c0306fe0 60000013 ffffffff
[   13.414286] Function entered at [<c0300b3c>] from [<c0306fe0>]
[   13.422442] Function entered at [<c0306fe0>] from [<c0351804>]
[   13.428171] Function entered at [<c0351804>] from [<c0351b68>]
[   13.433987] Function entered at [<c0351b68>] from [<80301510>]
[   13.439804] CPU0: stopping
[   13.445614] CPU: 0 PID: 612 Comm: uhttpd Tainted: G      D           5.15.137 #0
[   13.448313] Hardware name: Generic DT based system
[   13.455864] Function entered at [<c030d3a8>] from [<c0309784>]
[   13.460463] Function entered at [<c0309784>] from [<c060cd44>]
[   13.466279] Function entered at [<c060cd44>] from [<c030bf40>]
[   13.472095] Function entered at [<c030bf40>] from [<c030bf8c>]
[   13.477911] Function entered at [<c030bf8c>] from [<c03763b4>]
[   13.483726] Function entered at [<c03763b4>] from [<c0370588>]
[   13.489542] Function entered at [<c0370588>] from [<c0625194>]
[   13.495358] Function entered at [<c0625194>] from [<c0300e70>]
[   13.501174] Exception stack(0xc315bfb0 to 0xc315bff8)
[   13.506993] bfa0:                                     b6ea483c 0000002f 00000010 befc0fb5
[   13.512124] bfc0: 0000002f befb7638 00000010 b6ea483c 0007216c 00000000 b6ecbc80 b6ea4814
[   13.520280] bfe0: 00077d28 befb7508 0003ecdc b6f1d8c8 a0000010 ffffffff
[   13.528441] Rebooting in 1 seconds..

As I tried to flash initramfs again, it went up without a kernel panic, I'm afraid the luci-app-cpu-perf changed the CPU governor parameters somewhere, I found this topic here, not sure it has to do with it... maybe @frollic or someone with the same hardware can share their governor parameters. Thank you!

Here is a similar topic post:
https://forum.openwrt.org/t/how-do-i-permanently-change-the-scaling-governor-from-ondemand-to-performance/22688

Initramfs is just used to initially boot the system - it shouldn't stay anywhere - so that's expected. If you're using official images and immediately after installation you get crashes, then something is off. Or does it happen after you restore configuration?

Please also check if your power supply is stable, the unit is prone to rebooting if power supply quality is low.

Sometimes it crashes during initramfs upload, sometimes when sysupgrade is uploaded on initramfs from Luci. I'm not using any restore since I like to keep configuration as basic as possible. Good point! I'll check the power supply. Thank you!

EDIT: unfortunately the new power supply did not fix the kernel panic issue...

OLD: I connected a brand new 12V 2.5A power supply, and I did not get any crashes or restarts for now.

The ZTE still refuses to load the new sysupgrade, I tried with the both official 23.5.2 and 23.5.3, same results. I think mtd8 or 9 or some other partitions could be broken. Any way to wipe and format all partitions and start fresh? Thank you!

mtd erase rootfs should really be enough - as described in Cheap Router with LTE/4G, Wifi 2.4/5GHz and Eth-Ports - #60 by wrt4thg

Thank you! BTW I just got again a kernel panic, on a different CPU core also with the brand new power supply.

[   40.863547] 8<--- cut here ---
[   40.866707] device eth0 entered promiscuous mode
[   40.871507] Unhandled fault: external abort on non-linefetch (0x1008) at 0xc7cb9f00
[   40.879156] pgd = bcbb5fa5
[   40.886525] [c7cb9f00] *pgd=87c1141e(bad)
[   40.888707] qca8k-ipq4019 c000000.switch lan3: configuring for phy/psgmii link mode
[   40.889303] Internal error: : 1008 [#1] SMP ARM
[   40.895558] br-lan: port 2(lan3) entered blocking state
[   40.900849] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet ath10k_pci ath10k_core ath pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet
[   40.905376] br-lan: port 2(lan3) entered disabled state
[   40.905994] device lan3 entered promiscuous mode
[   40.910595]  nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211 cfg80211 slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c hwmon crc_ccitt compat sha512_arm ghash_arm_ce cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom gpio_button_hotplug crc32c_generic
[   40.936860] qca8k-ipq4019 c000000.switch lan4: configuring for phy/psgmii link mode
[   40.960474] CPU: 1 PID: 1734 Comm: S94gpio_switch Not tainted 5.15.137 #0
[   40.960506] Hardware name: Generic DT based system
[   40.960512] PC is at 0xc06095bc
[   40.960522] LR is at 0x0
[   40.960528] pc : [<c06095bc>]    lr : [<00000000>]    psr: 20000113
[   40.960536] sp : c33ffe98  ip : 00000000  fp : 00000255
[   40.960544] r10: 00000800  r9 : c32c92a0  r8 : c0312794
[   40.960551] r7 : cfed0d14  r6 : c7c5d000  r5 : c7cb9000  r4 : 00000000
[   40.984906] br-lan: port 3(lan4) entered blocking state
[   40.990263] r3 : 00000000  r2 : 00000001  r1 : c7cb9f00  r0 : c7c5df00
[   40.990294] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   40.990315] Control: 10c5387d  Table: 82df806a  DAC: 00000051
[   40.990322] Register r0 information: non-slab/vmalloc memory
[   40.990359] Register r1 information:
[   40.997245] br-lan: port 3(lan4) entered disabled state
[   41.001890]  non-slab/vmalloc memory
[   41.005404] device lan4 entered promiscuous mode
[   41.007705] Register r2 information: non-paged memory
[   41.007732] Register r3 information: NULL pointer
[   41.007740] Register r4 information:
[   41.024126] qca8k-ipq4019 c000000.switch wan: configuring for phy/psgmii link mode
[   41.030710]  NULL pointer
[   41.030722] Register r5 information: non-slab/vmalloc memory
[   41.030736] Register r6 information: non-slab/vmalloc memory
[   41.030745] Register r7 information: non-slab/vmalloc memory
[   41.112739] Register r8 information: non-slab/vmalloc memory
[   41.118381] Register r9 information: slab vm_area_struct start c32c92a0 pointer offset 0
[   41.124035] Register r10 information: non-paged memory
[   41.132102] Register r11 information: non-paged memory
[   41.137051] Register r12 information: NULL pointer
[   41.142173] Process S94gpio_switch (pid: 1734, stack limit = 0x0f916754)
[   41.146949] Stack: (0xc33ffe98 to 0xc3400000)
[   41.153820] fe80:                                                       ffffe000 c031280c
[   41.158076] fea0: c33fff04 cfed0d14 cfed1a04 c32c92a0 c0312794 c0441514 c189ad40 00000002
[   41.166222] fec0: 00000000 c1e9d800 c33ffedc c034bb64 00000001 c32c92a0 c33fe000 00000255
[   41.174382] fee0: 00000c73 c1876344 00000040 00000800 00000255 c0445d8c 20000013 00000013
[   41.182542] ff00: 00000000 c32c92a0 00000cc0 000b6e96 b6e96000 00000255 c2dfadb8 c2dfadb8
[   41.190702] ff20: 87cb97df 00000000 cfed1a04 c33d7258 cfe2da50 00000000 0000000d c33fffb0
[   41.198862] ff40: b6e9680c 0000080f c1e9d800 c32c92a0 c1e9d840 00000800 00000255 c030e168
[   41.207022] ff60: c030e060 0000080f b6e9680c c33fffb0 c1809ac0 10c5387d b6eb0d04 000786f4
[   41.215181] ff80: b6eb3010 c030e4a8 00000000 00000000 00000000 000006c8 00032f7c 80000010
[   41.223341] ffa0: ffffffff 10c5387d 10c5387d c0300e1c 000006c8 0000000c b6e96800 0000000c
[   41.231500] ffc0: b6e9680c 000006c8 00000000 b6eb07a4 0007870c b6eb0d04 000786f4 b6eb3010
[   41.239660] ffe0: 00077c44 bedb8770 b6f1639c 00032f7c 80000010 ffffffff 00000000 00000000
[   41.247826] Code: e8a05018 e8b15018 e2522001 e8a05018 (c8b15018)
[   41.255983] ---[ end trace bcbd9f4f0c062550 ]---
[   41.262045] Kernel panic - not syncing: Fatal exception
[   41.266736] CPU2: stopping
[   41.271680] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G      D           5.15.137 #0
[   41.274462] Hardware name: Generic DT based system
[   41.282017] Function entered at [<c030d3a8>] from [<c0309784>]
[   41.286700] Function entered at [<c0309784>] from [<c060cd44>]
[   41.292517] Function entered at [<c060cd44>] from [<c030bf40>]
[   41.298330] Function entered at [<c030bf40>] from [<c030bf8c>]
[   41.304146] Function entered at [<c030bf8c>] from [<c03763b4>]
[   41.309965] Function entered at [<c03763b4>] from [<c0370588>]
[   41.315781] Function entered at [<c0370588>] from [<c0625194>]
[   41.321596] Function entered at [<c0625194>] from [<c0300b3c>]
[   41.327411] Exception stack(0xc1c73f58 to 0xc1c73fa0)
[   41.333228] 3f40:                                                       00004120 00000000
[   41.338358] 3f60: 00000001 c0312e60 00000002 c1804f28 c1c72000 00000000 00000000 ffffe000
[   41.346519] 3f80: 00000000 c1804f5c c18bef40 c1c73fa8 c0306fdc c0306fe0 60000013 ffffffff
[   41.354673] Function entered at [<c0300b3c>] from [<c0306fe0>]
[   41.362828] Function entered at [<c0306fe0>] from [<c0351804>]
[   41.368557] Function entered at [<c0351804>] from [<c0351b68>]
[   41.374371] Function entered at [<c0351b68>] from [<80301510>]
[   41.380191] CPU3: stopping
[   41.385999] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G      D           5.15.137 #0
[   41.388696] Hardware name: Generic DT based system
[   41.396248] Function entered at [<c030d3a8>] from [<c0309784>]
[   41.400935] Function entered at [<c0309784>] from [<c060cd44>]
[   41.406750] Function entered at [<c060cd44>] from [<c030bf40>]
[   41.412566] Function entered at [<c030bf40>] from [<c030bf8c>]
[   41.418381] Function entered at [<c030bf8c>] from [<c03763b4>]
[   41.424197] Function entered at [<c03763b4>] from [<c0370588>]
[   41.430014] Function entered at [<c0370588>] from [<c0625194>]
[   41.435829] Function entered at [<c0625194>] from [<c0300b3c>]
[   41.441646] Exception stack(0xc1c75f58 to 0xc1c75fa0)
[   41.447464] 5f40:                                                       00002f2c 00000000
[   41.452594] 5f60: 00000001 c0312e60 00000003 c1804f28 c1c74000 00000000 00000000 ffffe000
[   41.460754] 5f80: 00000000 c1804f5c c18bef40 c1c75fa8 c0306fdc c0306fe0 60000013 ffffffff
[   41.468907] Function entered at [<c0300b3c>] from [<c0306fe0>]
[   41.477062] Function entered at [<c0306fe0>] from [<c0351804>]
[   41.482790] Function entered at [<c0351804>] from [<c0351b68>]
[   41.488607] Function entered at [<c0351b68>] from [<80301510>]
[   41.494424] CPU0: stopping
[   41.500236] CPU: 0 PID: 1770 Comm: utpl Tainted: G      D           5.15.137 #0
[   41.502932] Hardware name: Generic DT based system
[   41.510136] Function entered at [<c030d3a8>] from [<c0309784>]
[   41.514997] Function entered at [<c0309784>] from [<c060cd44>]
[   41.520814] Function entered at [<c060cd44>] from [<c030bf40>]
[   41.526629] Function entered at [<c030bf40>] from [<c030bf8c>]
[   41.532443] Function entered at [<c030bf8c>] from [<c03763b4>]
[   41.538261] Function entered at [<c03763b4>] from [<c0370588>]
[   41.544077] Function entered at [<c0370588>] from [<c0625194>]
[   41.549893] Function entered at [<c0625194>] from [<c0300e70>]
[   41.555707] Exception stack(0xc3101fb0 to 0xc3101ff8)
[   41.561529] 1fa0:                                     b6e295b0 b6e3deb0 b6e956c0 00000086
[   41.566657] 1fc0: bece4ca0 0000000a 00000027 b6eacdec 00000001 00000000 b6efb1d4 b6eacdec
[   41.574814] 1fe0: bece4ca0 bece4a48 b6ee9d2c b6ee9d2c 60000010 ffffffff
[   41.582974] Rebooting in 3 seconds..

Unfortunately it doesn't work :no_mouth:

BusyBox v1.36.1 (2023-11-14 13:38:11 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.2, r23630-842932a63d
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
root@OpenWrt:/#
root@OpenWrt:/# mtd erase rootfs
Unlocking rootfs ...
Erasing rootfs ...
root@OpenWrt:/# 

root@OpenWrt:/# [  142.032733] ubi: mtd9 is already attached to ubi0
[  142.490244] ubi: mtd9 is already attached to ubi0
[  172.079405] ubi: mtd9 is already attached to ubi0
[  172.552639] ubi: mtd9 is already attached to ubi0
[  185.475971] ubi: mtd9 is already attached to ubi0
[  185.968482] ubi: mtd9 is already attached to ubi0
[  187.638326] ubi: mtd9 is already attached to ubi0
[  188.095365] ubi: mtd9 is already attached to ubi0
Watchdog handover: fd=3
- watchdog -
Watchdog did not previously reset the system
Tue Nov 14 13:41:12 UTC 2023 upgrade: Sending TERM to remaining processes ...
Tue Nov 14 13:41:16 UTC 2023 upgrade: Sending KILL to remaining processes ...
[  198.743900] stage2 (2885): drop_caches: 3
Tue Nov 14 13:41:22 UTC 2023 upgrade: Switching to ramdisk...
Tue Nov 14 13:41:24 UTC 2023 upgrade: Performing system upgrade...
verifying sysupgrade tar file integrity
Volume ID 0, size 24 LEBs (3047424 bytes, 2.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 1, size 32 LEBs (4063232 bytes, 3.8 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 19300352
Volume ID 2, size 152 LEBs (19300352 bytes, 18.4 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy[  204.183363] reboot: Restarting system

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00126
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       262 - PBL, Start
B -      1342 - bootable_media_detect_entry, Start
B -      1683 - bootable_media_detect_success, Start
B -      1697 - elf_loader_entry, Start
B -      5105 - auth_hash_seg_entry, Start
B -      7269 - auth_hash_seg_exit, Start
B -    583054 - elf_segs_hash_verify_entry, Start
B -    701829 - PBL, End
B -    701853 - SBL1, Start
B -    792737 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    794209 - boot_flash_init, Start
D -     53180 - boot_flash_init, Delta
B -    851538 - boot_config_data_table_init, Start
D -      3857 - boot_config_data_table_init, Delta - (419 Bytes)
B -    858716 - clock_init, Start
D -      7740 - clock_init, Delta
B -    870932 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    874346 - sbl1_ddr_set_params, Start
B -    879443 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    883825 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13175 - sbl1_ddr_set_params, Delta
B -    897138 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    967545 - sbl1_wait_for_ddr_training, Start
D -        27 - sbl1_wait_for_ddr_training, Delta
B -    983135 - Image Load, Start
D -    153142 - QSEE Image Loaded, Delta - (299560 Bytes)
B -   1136704 - Image Load, Start
D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1146999 - Image Load, Start
D -    247701 - APPSBL Image Loaded, Delta - (507051 Bytes)
B -   1395097 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1401281 - SBL1, End
D -    701535 - SBL1, Delta
S - Flash Throughput, 2012 KB/s  (809078 Bytes,  402117 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07 [Chaos Calmer 15.05.1,IPQ4019.ILQ.6.1.0.r2-00006-P-1] (Apr 19 2021 - 23:50:05)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010001
NAND:  ID = 302012c
Vendor = 2c
Device = 1
ONFI device found
SF: Detected GD25Q16 with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 0
Uaztemain: enter into !
ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0x4e from 0x0
Press ESC to abort autoboot in 0 seconds
setenv - set environment variables

(IPQ40xx) #

I just remembered, just before the mf286d was not able to boot as described above, I mean when sysupgrade worked last time, I noticed only one WIFI radio was present in the wireless configuration LuCI pane.

BTW I have a complete Nordic dump (and then I'll eventually go back to OpenWRT), will it be useful to flash it back? I tried but some mtds are of course read-only and I'm not sure I'm going to damage it more than it is, maybe someone can point me out a guide do it myself.

Pretty sure the thread I linked to earlier, also tells you how to go back to stock.

at the bottom of the Device page https://openwrt.org/toh/zte/mf286d I found the OpenWrt bootlog normally ends up like this

ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0xff from 0x0
Hit any key to stop autoboot:  2  1  0 
Creating 1 MTD partitions on "nand0":
0x000001800000-0x000003500000 : "mtd=0"
...

mine instead is

ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0x4e from 0x0
Press ESC to abort autoboot in 0 seconds
setenv - set environment variables

(IPQ40xx) # 

it simply does not boot the kernel :smiling_face_with_tear:

So which is the mtd that contain that info? I have a nordic stock dump but I'm not sure how to rewrite all the partitions, I just understood mtd0 mtd1 and mtd2 must not be touched. because they contains uboot...

I checked for 3 hours to find a guide on how to flash back the stock mtds, but found nothing I can be sure to try. Can someone please kindly point me to the right guide? Thank you!

  1. Boot initrfams as for OpenWrt installation.
  2. One by one, copy over your mtd8 and mtd9 dump (or use one from here, appropriate to modem version: http://dl.eko.one.pl/orig/zte_mf286d/NORDIC/) ,
    using scp to /tmp, and then
mtd erase /dev/mtdN
mtd write /tmp/mtdN.bin /dev/mtdN
rm /tmp/mtdN.bin

You probably haven't touched mtd8 (web), neither does OpenWrt, so restoring just mtd9 should work.

Thank you very much for your kind reply!

Unfortunately it does not work as expected, I transfered via SCP both mtd8 and mtd9 starting from the B02 nordic dump and up to B12 available on MEGA without success, it still does not boot.

I issued also this command to see th emodem version, but unfortunately it does not give any answer:

echo -e -n 'ati' > /dev/ttyUSB1 && grep ":" /dev/ttyUSB1

Just for completeness, the modem led remains always red also with a working sim inserted.

Thank you in advance!

Below the log:

BusyBox v1.36.1 (2024-03-22 22:09:42 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.3, r23809-234f1a2efa
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# echo -e -n 'ati' > /dev/ttyUSB1 && grep ":" /dev/ttyUSB1
root@OpenWrt:/# mtd erase /dev/mtd8
Unlocking /dev/mtd8 ...
Erasing /dev/mtd8 ...
root@OpenWrt:/# mtd write /tmp/mtd8.bin /dev/mtd8
Unlocking /dev/mtd8 ...

Writing from /tmp/mtd8.bin to /dev/mtd8 ...
root@OpenWrt:/# rm /tmp/mtd8.bin
root@OpenWrt:/# mtd erase /dev/mtd9
Unlocking /dev/mtd9 ...
Erasing /dev/mtd9 ...
root@OpenWrt:/# mtd write /tmp/mtd9.bin /dev/mtd9
Unlocking /dev/mtd9 ...

Writing from /tmp/mtd9.bin to /dev/mtd9 ...
root@OpenWrt:/# rm /tmp/mtd9.bin
root@OpenWrt:/# reboot

U-Boot 2012.07 [Chaos Calmer 15.05.1,IPQ4019.ILQ.6.1.0.r2-00006-P-1] (Apr 19 2021 - 23:50:05)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010001
NAND:  ID = 302012c
Vendor = 2c
Device = 1
ONFI device found
SF: Detected GD25Q16 with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 0
Uaztemain: enter into !
ZTE_InitFotaFlashPara: nand_curr_device=0
zte_getHandOffState: read data=0x4e from 0x0
Press ESC to abort autoboot in 0 seconds
setenv - set environment variables

(IPQ40xx) #

So I was able to solve the boot problem, it seems the flash is getting faulty, so I reflashed all the mtds (using B06 dump) available from the initramfs, starting from the mtd3 up to mtd19, I found mtd11 has bad blocks, see logs:

root@OpenWrt:/# mtd erase /dev/mtd11
Unlocking /dev/mtd11 ...
Erasing /dev/mtd11 ...

Skipping bad block at 0x20000
Skipping bad block at 0xc0000
Skipping bad block at 0xe0000
Skipping bad block at 0x100000
Skipping bad block at 0x120000
Skipping bad block at 0x140000
Skipping bad block at 0x160000
Skipping bad block at 0x180000
Skipping bad block at 0x1a0000
Skipping bad block at 0x1c0000
Skipping bad block at 0x1e0000
Skipping bad block at 0x200000
Skipping bad block at 0x220000
Skipping bad block at 0x240000
Skipping bad block at 0x260000
Skipping bad block at 0x280000
Skipping bad block at 0x2a0000
Skipping bad block at 0x2c0000
Skipping bad block at 0x2e0000
Skipping bad block at 0x300000
Skipping bad block at 0x320000
Skipping bad block at 0x340000
Skipping bad block at 0x360000
Skipping bad block at 0x380000
Skipping bad block at 0x3a0000
Skipping bad block at 0x3c0000
Skipping bad block at 0x3e0000
Skipping bad block at 0x400000
Skipping bad block at 0x420000
Skipping bad block at 0x440000
Skipping bad block at 0x460000
Skipping bad block at 0x480000
Skipping bad block at 0x4a0000
Skipping bad block at 0x4c0000
Skipping bad block at 0x4e0000
Skipping bad block at 0x500000
Skipping bad block at 0x1420000
Skipping bad block at 0x1460000
Skipping bad block at 0x1480000
Skipping bad block at 0x14a0000
Skipping bad block at 0x14c0000
Skipping bad block at 0x14e0000
Skipping bad block at 0x1500000
Skipping bad block at 0x1520000
Skipping bad block at 0x1540000
Skipping bad block at 0x15a0000
Skipping bad block at 0x15e0000
Skipping bad block at 0x1600000
Skipping bad block at 0x1620000
Skipping bad block at 0x1640000
Skipping bad block at 0x1660000
Skipping bad block at 0x1680000
Skipping bad block at 0x16a0000
Skipping bad block at 0x16c0000
Skipping bad block at 0x16e0000
Skipping bad block at 0x1700000
Skipping bad block at 0x1720000
Skipping bad block at 0x1740000
Skipping bad block at 0x1760000
Skipping bad block at 0x1780000
Skipping bad block at 0x17a0000
Skipping bad block at 0x17c0000
Skipping bad block at 0x17e0000
Skipping bad block at 0x1800000
Skipping bad block at 0x1820000
Skipping bad block at 0x1840000
Skipping bad block at 0x1860000
Skipping bad block at 0x1880000
Skipping bad block at 0x18a0000
Skipping bad block at 0x18c0000
Skipping bad block at 0x18e0000
Skipping bad block at 0x1900000
Skipping bad block at 0x1920000
Skipping bad block at 0x1940000
Skipping bad block at 0x1960000
Skipping bad block at 0x1980000
Skipping bad block at 0x19a0000
Skipping bad block at 0x19c0000
Skipping bad block at 0x19e0000
Skipping bad block at 0x1a00000
Skipping bad block at 0x1a20000
Skipping bad block at 0x1a40000
Skipping bad block at 0x1a60000
Skipping bad block at 0x1a80000
Skipping bad block at 0x1aa0000
Skipping bad block at 0x1ac0000
Skipping bad block at 0x1ae0000
Skipping bad block at 0x1b00000
Skipping bad block at 0x1b20000
Skipping bad block at 0x1b40000
Skipping bad block at 0x1b60000
Skipping bad block at 0x1b80000
Skipping bad block at 0x1ba0000
Skipping bad block at 0x1bc0000
Skipping bad block at 0x1be0000
Skipping bad block at 0x1c00000
Skipping bad block at 0x1c20000
Skipping bad block at 0x1c40000
Skipping bad block at 0x1c60000
Skipping bad block at 0x1c80000
Skipping bad block at 0x1ca0000
Skipping bad block at 0x1cc0000
Skipping bad block at 0x1ce0000
Skipping bad block at 0x1d00000
Skipping bad block at 0x1d20000
Skipping bad block at 0x1d40000
Skipping bad block at 0x1d60000
Skipping bad block at 0x1d80000
Skipping bad block at 0x1da0000
Skipping bad block at 0x1dc0000
Skipping bad block at 0x1de0000
Skipping bad block at 0x1e00000
Skipping bad block at 0x1e20000
Skipping bad block at 0x1e40000
Skipping bad block at 0x1e60000
Skipping bad block at 0x1e80000
Skipping bad block at 0x1ea0000
Skipping bad block at 0x1ec0000
Skipping bad block at 0x1ee0000
Skipping bad block at 0x1f00000
Skipping bad block at 0x1f20000
Skipping bad block at 0x1f40000
Skipping bad block at 0x1f60000
Skipping bad block at 0x1f80000
Skipping bad block at 0x1fa0000
Skipping bad block at 0x1fc0000
Skipping bad block at 0x1fe0000
Skipping bad block at 0x2000000
Skipping bad block at 0x2020000
Skipping bad block at 0x2040000
Skipping bad block at 0x2060000
Skipping bad block at 0x2080000
Skipping bad block at 0x20a0000
Skipping bad block at 0x20c0000
Skipping bad block at 0x20e0000
Skipping bad block at 0x2100000
Skipping bad block at 0x2120000
Skipping bad block at 0x2140000
Skipping bad block at 0x2160000
Skipping bad block at 0x2180000
Skipping bad block at 0x21a0000
Skipping bad block at 0x21c0000
Skipping bad block at 0x21e0000
Skipping bad block at 0x2200000
Skipping bad block at 0x2220000
Skipping bad block at 0x2240000
Skipping bad block at 0x2260000
Skipping bad block at 0x2280000
Skipping bad block at 0x22a0000
Skipping bad block at 0x22c0000
Skipping bad block at 0x22e0000
Skipping bad block at 0x2300000
Skipping bad block at 0x2320000
Skipping bad block at 0x2340000
Skipping bad block at 0x2360000
Skipping bad block at 0x2380000
Skipping bad block at 0x23a0000
Skipping bad block at 0x23c0000
Skipping bad block at 0x23e0000
Skipping bad block at 0x2400000
Skipping bad block at 0x2420000
Skipping bad block at 0x2440000
Skipping bad block at 0x2460000
Skipping bad block at 0x2480000
Skipping bad block at 0x24a0000
Skipping bad block at 0x24c0000
Skipping bad block at 0x24e0000
Skipping bad block at 0x2500000
Skipping bad block at 0x2520000
Skipping bad block at 0x2540000
Skipping bad block at 0x2560000
Skipping bad block at 0x2580000
Skipping bad block at 0x25a0000
Skipping bad block at 0x25c0000
Skipping bad block at 0x25e0000
Skipping bad block at 0x2600000
Skipping bad block at 0x2620000
Skipping bad block at 0x2640000
Skipping bad block at 0x2660000
Skipping bad block at 0x2680000
Skipping bad block at 0x26a0000
Skipping bad block at 0x26c0000
Skipping bad block at 0x26e0000
Skipping bad block at 0x2700000
Skipping bad block at 0x2720000
Skipping bad block at 0x2740000
Skipping bad block at 0x2760000
Skipping bad block at 0x2780000
Skipping bad block at 0x27a0000
Skipping bad block at 0x27c0000
Skipping bad block at 0x27e0000
Skipping bad block at 0x2800000
Skipping bad block at 0x2820000
Skipping bad block at 0x2840000
Skipping bad block at 0x2860000
Skipping bad block at 0x2880000
Skipping bad block at 0x28a0000
Skipping bad block at 0x28c0000
Skipping bad block at 0x28e0000
Skipping bad block at 0x2900000
Skipping bad block at 0x2920000
Skipping bad block at 0x2940000
Skipping bad block at 0x2960000
Skipping bad block at 0x2980000
Skipping bad block at 0x29a0000
Skipping bad block at 0x29c0000
Skipping bad block at 0x29e0000
Skipping bad block at 0x2a00000
Skipping bad block at 0x2a20000
Skipping bad block at 0x2a40000
Skipping bad block at 0x2a60000
Skipping bad block at 0x2a80000
Skipping bad block at 0x2aa0000
Skipping bad block at 0x2ac0000
Skipping bad block at 0x2ae0000
Skipping bad block at 0x2b00000
Skipping bad block at 0x2b20000
Skipping bad block at 0x2b40000
Skipping bad block at 0x2b60000
Skipping bad block at 0x2b80000
Skipping bad block at 0x2ba0000
Skipping bad block at 0x2bc0000
Skipping bad block at 0x2be0000
Skipping bad block at 0x2c00000
Skipping bad block at 0x2c20000
Skipping bad block at 0x2c40000
Skipping bad block at 0x2c60000
Skipping bad block at 0x2c80000
Skipping bad block at 0x2ca0000
Skipping bad block at 0x2cc0000
Skipping bad block at 0x2ce0000
Skipping bad block at 0x2d00000
Skipping bad block at 0x2d20000
Skipping bad block at 0x2d40000
Skipping bad block at 0x2d60000
Skipping bad block at 0x2d80000
Skipping bad block at 0x2da0000
Skipping bad block at 0x2dc0000
Skipping bad block at 0x2de0000
Skipping bad block at 0x2e00000
Skipping bad block at 0x2e20000
Skipping bad block at 0x2e40000
Skipping bad block at 0x2e60000
Skipping bad block at 0x2e80000
Skipping bad block at 0x2ea0000
Skipping bad block at 0x2ec0000
Skipping bad block at 0x2ee0000
Skipping bad block at 0x2f00000
Skipping bad block at 0x2f20000
Skipping bad block at 0x2f40000
Skipping bad block at 0x2f60000
Skipping bad block at 0x2f80000
Skipping bad block at 0x2fa0000
Skipping bad block at 0x2fc0000
Skipping bad block at 0x2fe0000
Skipping bad block at 0x3000000
Skipping bad block at 0x3020000
Skipping bad block at 0x3040000
Skipping bad block at 0x3060000
Skipping bad block at 0x3080000
Skipping bad block at 0x30a0000
Skipping bad block at 0x30c0000
Skipping bad block at 0x30e0000
Skipping bad block at 0x3100000
Skipping bad block at 0x3120000
Skipping bad block at 0x3140000
Skipping bad block at 0x3160000
Skipping bad block at 0x3180000
Skipping bad block at 0x31a0000
Skipping bad block at 0x31c0000
Skipping bad block at 0x31e0000 

root@OpenWrt:/# mtd write /tmp/mtd11.bin /dev/mtd11
Unlocking /dev/mtd11 ...

Writing from /tmp/mtd11.bin to /dev/mtd11 ...  [e]
Skipping bad block at 0x00020000[e]
Skipping bad block at 0x000c0000[e]
Skipping bad block at 0x000e0000[e]
Skipping bad block at 0x00100000[e]
Skipping bad block at 0x00120000[e]
Skipping bad block at 0x00140000[e]
Skipping bad block at 0x00160000[e]
Skipping bad block at 0x00180000[e]
Skipping bad block at 0x001a0000[e]
Skipping bad block at 0x001c0000[e]
Skipping bad block at 0x001e0000[e]
Skipping bad block at 0x00200000[e]
Skipping bad block at 0x00220000[e]
Skipping bad block at 0x00240000[e]
Skipping bad block at 0x00260000[e]
Skipping bad block at 0x00280000[e]
Skipping bad block at 0x002a0000[e]
Skipping bad block at 0x002c0000[e]
Skipping bad block at 0x002e0000[e]
Skipping bad block at 0x00300000[e]
Skipping bad block at 0x00320000[e]
Skipping bad block at 0x00340000[e]
Skipping bad block at 0x00360000[e]
Skipping bad block at 0x00380000[e]
Skipping bad block at 0x003a0000[e]
Skipping bad block at 0x003c0000[e]
Skipping bad block at 0x003e0000[e]
Skipping bad block at 0x00400000[e]
Skipping bad block at 0x00420000[e]
Skipping bad block at 0x00440000[e]
Skipping bad block at 0x00460000[e]
Skipping bad block at 0x00480000[e]
Skipping bad block at 0x004a0000[e]
Skipping bad block at 0x004c0000[e]
Skipping bad block at 0x004e0000[e]
Skipping bad block at 0x00500000[e]
Skipping bad block at 0x01420000[e]
Skipping bad block at 0x01460000[e]
Skipping bad block at 0x01480000[e]
Skipping bad block at 0x014a0000[e]
Skipping bad block at 0x014c0000[e]
Skipping bad block at 0x014e0000[e]
Skipping bad block at 0x01500000[e]
Skipping bad block at 0x01520000[e]
Skipping bad block at 0x01540000[e]
Skipping bad block at 0x015a0000[e]
Skipping bad block at 0x015e0000[e]
Skipping bad block at 0x01600000[e]
Skipping bad block at 0x01620000[e]
Skipping bad block at 0x01640000[e]
Skipping bad block at 0x01660000[e]
Skipping bad block at 0x01680000[e]
Skipping bad block at 0x016a0000[e]
Skipping bad block at 0x016c0000[e]
Skipping bad block at 0x016e0000[e]
Skipping bad block at 0x01700000[e]
Skipping bad block at 0x01720000[e]
Skipping bad block at 0x01740000[e]
Skipping bad block at 0x01760000[e]
Skipping bad block at 0x01780000[e]
Skipping bad block at 0x017a0000[e]
Skipping bad block at 0x017c0000[e]
Skipping bad block at 0x017e0000[e]
Skipping bad block at 0x01800000[e]
Skipping bad block at 0x01820000[e]
Skipping bad block at 0x01840000[e]
Skipping bad block at 0x01860000[e]
Skipping bad block at 0x01880000[e]
Skipping bad block at 0x018a0000[e]
Skipping bad block at 0x018c0000[e]
Skipping bad block at 0x018e0000[e]
Skipping bad block at 0x01900000[e]
Skipping bad block at 0x01920000[e]
Skipping bad block at 0x01940000[e]
Skipping bad block at 0x01960000[e]
Skipping bad block at 0x01980000[e]
Skipping bad block at 0x019a0000[e]
Skipping bad block at 0x019c0000[e]
Skipping bad block at 0x019e0000[e]
Skipping bad block at 0x01a00000[e]
Skipping bad block at 0x01a20000[e]
Skipping bad block at 0x01a40000[e]
Skipping bad block at 0x01a60000[e]
Skipping bad block at 0x01a80000[e]
Skipping bad block at 0x01aa0000[e]
Skipping bad block at 0x01ac0000[e]
Skipping bad block at 0x01ae0000[e]
Skipping bad block at 0x01b00000[e]
Skipping bad block at 0x01b20000[e]
Skipping bad block at 0x01b40000[e]
Skipping bad block at 0x01b60000[e]
Skipping bad block at 0x01b80000[e]
Skipping bad block at 0x01ba0000[e]
Skipping bad block at 0x01bc0000[e]
Skipping bad block at 0x01be0000[e]
Skipping bad block at 0x01c00000[e]
Skipping bad block at 0x01c20000[e]
Skipping bad block at 0x01c40000[e]
Skipping bad block at 0x01c60000[e]
Skipping bad block at 0x01c80000[e]
Skipping bad block at 0x01ca0000[e]
Skipping bad block at 0x01cc0000[e]
Skipping bad block at 0x01ce0000[e]
Skipping bad block at 0x01d00000[e]
Skipping bad block at 0x01d20000[e]
Skipping bad block at 0x01d40000[e]
Skipping bad block at 0x01d60000[e]
Skipping bad block at 0x01d80000[e]
Skipping bad block at 0x01da0000[e]
Skipping bad block at 0x01dc0000[e]
Skipping bad block at 0x01de0000[e]
Skipping bad block at 0x01e00000[e]
Skipping bad block at 0x01e20000[e]
Skipping bad block at 0x01e40000[e]
Skipping bad block at 0x01e60000[e]
Skipping bad block at 0x01e80000[e]
Skipping bad block at 0x01ea0000[e]
Skipping bad block at 0x01ec0000[e]
Skipping bad block at 0x01ee0000[e]
Skipping bad block at 0x01f00000[e]
Skipping bad block at 0x01f20000[e]
Skipping bad block at 0x01f40000[e]
Skipping bad block at 0x01f60000[e]
Skipping bad block at 0x01f80000[e]
Skipping bad block at 0x01fa0000[e]
Skipping bad block at 0x01fc0000[e]
Skipping bad block at 0x01fe0000[e]
Skipping bad block at 0x02000000[e]
Skipping bad block at 0x02020000[e]
Skipping bad block at 0x02040000[e]
Skipping bad block at 0x02060000[e]
Skipping bad block at 0x02080000[e]
Skipping bad block at 0x020a0000[e]
Skipping bad block at 0x020c0000[e]
Skipping bad block at 0x020e0000[e]
Skipping bad block at 0x02100000[e]
Skipping bad block at 0x02120000[e]
Skipping bad block at 0x02140000[e]
Skipping bad block at 0x02160000[e]
Skipping bad block at 0x02180000[e]
Skipping bad block at 0x021a0000[e]
Skipping bad block at 0x021c0000[e]
Skipping bad block at 0x021e0000[e]
Skipping bad block at 0x02200000[e]
Skipping bad block at 0x02220000[e]
Skipping bad block at 0x02240000[e]
Skipping bad block at 0x02260000[e]
Skipping bad block at 0x02280000[e]
Skipping bad block at 0x022a0000[e]
Skipping bad block at 0x022c0000[e]
Skipping bad block at 0x022e0000[e]
Skipping bad block at 0x02300000[e]
Skipping bad block at 0x02320000[e]
Skipping bad block at 0x02340000[e]
Skipping bad block at 0x02360000[e]
Skipping bad block at 0x02380000[e]
Skipping bad block at 0x023a0000[e]
Skipping bad block at 0x023c0000[e]
Skipping bad block at 0x023e0000[e]
Skipping bad block at 0x02400000[e]
Skipping bad block at 0x02420000[e]
Skipping bad block at 0x02440000[e]
Skipping bad block at 0x02460000[e]
Skipping bad block at 0x02480000[e]
Skipping bad block at 0x024a0000[e]
Skipping bad block at 0x024c0000[e]
Skipping bad block at 0x024e0000[e]
Skipping bad block at 0x02500000[e]
Skipping bad block at 0x02520000[e]
Skipping bad block at 0x02540000[e]
Skipping bad block at 0x02560000[e]
Skipping bad block at 0x02580000[e]
Skipping bad block at 0x025a0000[e]
Skipping bad block at 0x025c0000[e]
Skipping bad block at 0x025e0000[e]
Skipping bad block at 0x02600000[e]
Skipping bad block at 0x02620000[e]
Skipping bad block at 0x02640000[e]
Skipping bad block at 0x02660000[e]
Skipping bad block at 0x02680000[e]
Skipping bad block at 0x026a0000[e]
Skipping bad block at 0x026c0000[e]
Skipping bad block at 0x026e0000[e]
Skipping bad block at 0x02700000[e]
Skipping bad block at 0x02720000[e]
Skipping bad block at 0x02740000[e]
Skipping bad block at 0x02760000[e]
Skipping bad block at 0x02780000[e]
Skipping bad block at 0x027a0000[e]
Skipping bad block at 0x027c0000[e]
Skipping bad block at 0x027e0000[e]
Skipping bad block at 0x02800000[e]
Skipping bad block at 0x02820000[e]
Skipping bad block at 0x02840000[e]
Skipping bad block at 0x02860000[e]
Skipping bad block at 0x02880000[e]
Skipping bad block at 0x028a0000[e]
Skipping bad block at 0x028c0000[e]
Skipping bad block at 0x028e0000[e]
Skipping bad block at 0x02900000[e]
Skipping bad block at 0x02920000[e]
Skipping bad block at 0x02940000[e]
Skipping bad block at 0x02960000[e]
Skipping bad block at 0x02980000[e]
Skipping bad block at 0x029a0000[e]
Skipping bad block at 0x029c0000[e]
Skipping bad block at 0x029e0000[e]
Skipping bad block at 0x02a00000[e]
Skipping bad block at 0x02a20000[e]
Skipping bad block at 0x02a40000[e]
Skipping bad block at 0x02a60000[e]
Skipping bad block at 0x02a80000[e]
Skipping bad block at 0x02aa0000[e]
Skipping bad block at 0x02ac0000[e]
Skipping bad block at 0x02ae0000[e]
Skipping bad block at 0x02b00000[e]
Skipping bad block at 0x02b20000[e]
Skipping bad block at 0x02b40000[e]
Skipping bad block at 0x02b60000[e]
Skipping bad block at 0x02b80000[e]
Skipping bad block at 0x02ba0000[e]
Skipping bad block at 0x02bc0000[e]
Skipping bad block at 0x02be0000[e]
Skipping bad block at 0x02c00000[e]
Skipping bad block at 0x02c20000[e]
Skipping bad block at 0x02c40000[e]
Skipping bad block at 0x02c60000[e]
Skipping bad block at 0x02c80000[e]
Skipping bad block at 0x02ca0000[e]
Skipping bad block at 0x02cc0000[e]
Skipping bad block at 0x02ce0000[e]
Skipping bad block at 0x02d00000[e]
Skipping bad block at 0x02d20000[e]
Skipping bad block at 0x02d40000[e]
Skipping bad block at 0x02d60000[e]
Skipping bad block at 0x02d80000[e]
Skipping bad block at 0x02da0000[e]
Skipping bad block at 0x02dc0000[e]
Skipping bad block at 0x02de0000[e]
Skipping bad block at 0x02e00000[e]
Skipping bad block at 0x02e20000[e]
Skipping bad block at 0x02e40000[e]
Skipping bad block at 0x02e60000[e]
Skipping bad block at 0x02e80000[e]
Skipping bad block at 0x02ea0000[e]
Skipping bad block at 0x02ec0000[e]
Skipping bad block at 0x02ee0000[e]
Skipping bad block at 0x02f00000[e]
Skipping bad block at 0x02f20000[e]
Skipping bad block at 0x02f40000[e]
Skipping bad block at 0x02f60000[e]
Skipping bad block at 0x02f80000[e]
Skipping bad block at 0x02fa0000[e]
Skipping bad block at 0x02fc0000[e]
Skipping bad block at 0x02fe0000[e]
Skipping bad block at 0x03000000[e]
Skipping bad block at 0x03020000[e]
Skipping bad block at 0x03040000[e]
Skipping bad block at 0x03060000[e]
Skipping bad block at 0x03080000[e]
Skipping bad block at 0x030a0000[e]
Skipping bad block at 0x030c0000[e]
Skipping bad block at 0x030e0000[e]
Skipping bad block at 0x03100000[e]
Skipping bad block at 0x03120000[e]
Skipping bad block at 0x03140000[e]
Skipping bad block at 0x03160000[e]
Skipping bad block at 0x03180000[e]
Skipping bad block at 0x031a0000[e]
Skipping bad block at 0x031c0000[e]
Skipping bad block at 0x031e0000[e]Failed to get erase block status

Now it boots into the firmware but I still had 3 crashes before it started up "normally", any chance to make a mtd11 deep check to find more bad blocks, or is it doing it in background by itself?

It seems crashes are invoked by the modem when it is not ready. Not sure about that, I hope someone can help.

I think you should hit it with ZTE update framework - if you haven't already done so - and try resetting it to factory defaults with AT commands, so the modem gets a clean reflash as well - because it can indeed reset the router part if it crashes.

As for FOTA partition (mtd11) I haven't touched stock FW for a long time, but I recall yaffs was used there. So just erasing it should do the trick, but you might want to preserve information on the existing bad blocks, so check that with nand-utils, there was a tool for scanning for bad blocks. But this is a second step - do a complete factory reflash with the framework first.

Thank you for your reply, I was able to restore mtd8/9, boot onto nordic, I'm sure i flashed the B06 but seems the B12 is in place, very strange. I restored to factory defaults and tried to use the framewwork to restore all as you adviced. DHCP is working and internet surfing as well, the framwework is not detecting the ZTE, I already checked firewall and common guidelines workarounds without success, I will try with a win11 clean install and update this post. CPU reboot obviously still remains. Thank you!

[  562.252371] CPU: 1 PID: 0 Comm: swapper/1 Tainted: P             3.14.77 #1
[  562.259331] [<c021e348>] (unwind_backtrace) from [<c021b21c>] (show_stack+0x10/0x14)
[  562.267045] [<c021b21c>] (show_stack) from [<c03eed14>] (dump_stack+0x80/0xa0)
[  562.274249] [<c03eed14>] (dump_stack) from [<c022c568>] (warn_slowpath_common+0x64/0x88)
[  562.282322] [<c022c568>] (warn_slowpath_common) from [<c022c5b8>] (warn_slowpath_fmt+0x2c/0x3c)
[  562.291003] [<c022c5b8>] (warn_slowpath_fmt) from [<c05fe328>] (dev_watchdog+0x1a4/0x22c)
[  562.299163] [<c05fe328>] (dev_watchdog) from [<c02355d0>] (call_timer_fn+0x20/0x80)
[  562.306799] [<c02355d0>] (call_timer_fn) from [<c02360a8>] (run_timer_softirq+0x190/0x1bc)
[  562.315047] [<c02360a8>] (run_timer_softirq) from [<c0230444>] (__do_softirq+0x104/0x294)
[  562.323205] [<c0230444>] (__do_softirq) from [<c02308c0>] (irq_exit+0x9c/0x11c)
[  562.330495] [<c02308c0>] (irq_exit) from [<c0218ba0>] (handle_IRQ+0x6c/0x90)
[  562.337529] [<c0218ba0>] (handle_IRQ) from [<c02084e0>] (gic_handle_irq+0x3c/0x60)
[  562.345078] [<c02084e0>] (gic_handle_irq) from [<c02095c0>] (__irq_svc+0x40/0x70)
[  562.352534] Exception stack(0xcf8c3fa0 to 0xcf8c3fe8)
[  562.357578] 3fa0: ffffffed 00000000 0f4fd000 c020a040 cf8c2000 cf8c2030 10c0387d c093ac08
[  562.365737] 3fc0: 8020406a 410fc075 00000000 00000000 00000000 cf8c3fe8 c0218e88 c0218e8c
[  562.373889] 3fe0: 60000013 ffffffff
[  562.377371] [<c02095c0>] (__irq_svc) from [<c0218e8c>] (arch_cpu_idle+0x38/0x5c)
[  562.384753] [<c0218e8c>] (arch_cpu_idle) from [<c026b5c8>] (cpu_startup_entry+0xa4/0x108)
[  562.392963] [<c026b5c8>] (cpu_startup_entry) from [<802085a4>] (0x802085a4)
[  562.399869] ---[ end trace 14a7d45ba8633956 ]---

big problem I was able to start the framework update on a second laptop, unfortunately it went into sleep mode.... :hot_face: it seems it was interrupted when the modem was updating the firmware, all the leds are turned off, serial console seems live, but I'm getting this... I think at this point the router died definitley... :skull_and_crossbones:

[ 1279.841804] hub 2-0:1.0: unable to enumerate USB device on port 1
[ 1280.011918] usb 2-1: Device not responding to setup address.
[ 1280.221784] usb 2-1: Device not responding to setup address.
[ 1280.431717] usb 2-1: device not accepting address 40, error -71
[ 1280.581923] usb 2-1: Device not responding to setup address.
[ 1280.791783] usb 2-1: Device not responding to setup address.
[ 1281.001745] usb 2-1: device not accepting address 41, error -71
[ 1281.151917] usb 2-1: Device not responding to setup address.
[ 1281.361783] usb 2-1: Device not responding to setup address.
[ 1281.571715] usb 2-1: device not accepting address 42, error -71
[ 1281.721921] usb 2-1: Device not responding to setup address.
[ 1281.931803] usb 2-1: Device not responding to setup address.
[ 1282.141734] usb 2-1: device not accepting address 43, error -71
[ 1282.171782] hub 2-0:1.0: unable to enumerate USB device on port 1
[ 1282.341944] usb 2-1: Device not responding to setup address.
[ 1282.551777] usb 2-1: Device not responding to setup address.
[ 1282.761713] usb 2-1: device not accepting address 44, error -71
[ 1282.911929] usb 2-1: Device not responding to setup address.
[ 1283.121804] usb 2-1: Device not responding to setup address.
[ 1283.331714] usb 2-1: device not accepting address 45, error -71
[ 1283.481922] usb 2-1: Device not responding to setup address.
[ 1283.691783] usb 2-1: Device not responding to setup address.
[ 1283.901718] usb 2-1: device not accepting address 46, error -71
[ 1284.051916] usb 2-1: Device not responding to setup address.
[ 1284.261777] usb 2-1: Device not responding to setup address.
[ 1284.471713] usb 2-1: device not accepting address 47, error -71
[ 1284.501781] hub 2-0:1.0: unable to enumerate USB device on port 1
[ 1284.671925] usb 2-1: Device not responding to setup address.


UPDATE: I was able to flash back MTD8/9 and access the web ui, it says "limited service" on the network type, login box not showing up, only a loading wheel.

Oh geez, that's tough luck. But modem is still recoverable if you can connect it to PC using minicard-to-USB adapter and using QPST. The well known MEGA folder has documentation for that.
You can use translator to read that topic: https://eko.one.pl/forum/viewtopic.php?id=21790 - first post has a tutorial for it.

But if you loaded Nordic B12, and the hardware still misbehaves, then the hardware i probably faulty indeed.

So I was able to recover successfully the modem part using the guide you posted just above, Thank you! BTW was impossible to restore the router with the ZTE framework as the CPU crashes continuously. I put back OpenWrt 23.5.3 (the 23.5.2 crash the same way) and updated the modem to B12 just in case. I also tested various different 12V 1.5-2.5A power supplies since these voltagea are common to find, no luck on stability. I installed back the https://github.com/gSpotx2f/luci-app-cpu-perf
and locked the frequency at 500Mhz on all 4 cores, but it still give segmant faults and pointer errors sometimes. Clearly Leo-PL was right, the system itself is on its end of life. I tried to find a guide to force scan all the MTDs and mark bad sectors, I was not able to find a clear guide to do that.

This will be the last thing I'll try, then I will declare the patient flatlined :rofl: :skull_and_crossbones: :rofl:

Thank you very much to all the people in particular Leo-PL for the help given!!

EDIT: I have a second identical MF286D, I can notice, and very clearly a big difference in led brightness, the broken one is way dimmer, maybe could be a fried power regulator. I'm not sure if I will investigate further.