ASUS ZenWiFi XT9 boot failure – SPL starts but MCB / firmware checksum errors (looking for NAND dump or recovery ideas)

[Tagliatella]

Hi everyone,


I'm trying to recover a (semi?)bricked ASUS ZenWiFi XT9 and I'm documenting what I found in case someone has encountered the same issue.

Upon turning it on, a solid white LED turns rapidly into a breathing green LED and nothing else happens, all kind of reset/wps button and wait combinations have been tried already.

The router still boots partially and I have access to the serial console via UART (TTL).

Hardware platform appears to be based on the MediaTek MT7986A (Filogic).

Boot behaviour​

BootROM runs correctly and loads the SPL, but the boot process stops because the firmware structure in NAND appears corrupted.
Key observations from the serial console:

• BootROM runs (BTRM V3.0)
• NAND is detected correctly
• SPL starts normally
• Firmware header is found
• CRC / SHA256 checks fail
• MCB (MediaTek Control Block) cannot be loaded
• Boot stops with error

So the system reaches U-Boot SPL, but never loads full U-Boot.

Serial console log​

Relevant output​

U-Boot SPL 2019.07 (Apr 08 2022 - 13:50:50 +0800)
Strap register: 0x7fffff43
nand flash device id 0xc2da9091, total size 256MB
block size 128KB, page size 2048 bytes
find magic number 0x75456e76 at address 0x40000
CRC mismatch
find magic number 0xcb00cb at address 0xa7000
digest sha256 mismatch
mcb load failed
### ERROR ### Please RESET the board ###

Current diagnosis​

So far everything suggests:

• BootROM OK
• SPL OK
• NAND hardware OK
• MCB / firmware contents corrupted

Because SPL stops before loading full U-Boot, none of the usual recovery methods work:

• All kind of combinations of "RESET, WPS, delays, waits, reboots, and short and long presses" switches recovery
• ASUS Firmware Restoration
• TFTP recovery

Ethernet ports don't get opened/loaded.

I also attempted:

• UART interaction (no console in SPL)
• forcing NAND read errors to trigger fallback (shorting pins)
• trying to force BROM mode

No success so far.

NAND chip​

The router uses:

Macronix MX30LF2G28AD
256MB NAND
TSOP-48

What I'm looking for​

I'm trying to avoid desoldering the NAND chip if possible.


Does anyone happen to have:

- A full NAND dump from a working ZenWiFi XT9
or
- Information about the MCB layout used by ASUS on MT7986 routers
or
- Any recovery method that works before U-Boot loads

Perhaps even partial dumps or partition layouts could help reconstruct the NAND?


Thanks in advance for any ideas!