Despite numerous attempts, I've been unable to restore Buffalo's original firmware images on this device.
It seems like the WZR-900DHP-EU doesn't accept TFTP uploads even though boot_wait has been enabled in the NVRAM. I've tried the arp tricks and the magic IP 192.168.11.1, but at no point during boot does the device answer to ARP or ICMP requests with this IP. Neither does it open the TFTP ports for receiving the upload.
Instead, the device tries to TFTP download the file linux.trx-recovery from 192.168.1.2 upon boot. While the device is fetching linux.trx-recovery, a CFE web gui is enabled. By throttling the TFTP server, I've tried to use the CFE gui to upload Buffalo's firmware images, but the CFE claims that the images are invalid and refuses to flash them.
I've also tried converting Buffalo's firmware images into .trx files with dd bs=32 skip=1, but no go. According to the following post, it seems that Buffalo's firmware images are encrypted and indeed, the files seem to begin with the characters 'bgn'.
https://forum.openwrt.org/viewtopic.php?id=34212
Thus, the firmware images are not accepted by mtd or dd-wrt's web GUI. With mtd the error is "bad trx header", perhaps unsurprisingly. dd-wrt just reboots back into the previous firmware, ignoring the update.
For some Buffalo devices, there exists a modified firmware image that is acceptable by the dd-wrt web gui (and possibly mtd). After flashing the modified image, one can the follow up by flashing one of the Buffalo encrypted images. However, I've been unable to figure out how to hack such an image for the WZR-900DHP. Any pointers?