There's a specific kind of evening that begins with "this'll only take twenty minutes" and ends with you hunched over a desk at one in the morning, prodding test points with a multimeter and quietly apologising to a circuit board. This is the story of one of those.
The router in question was working perfectly. That's the important part, the part I'd like you to remember as the story unfolds. It did everything I needed. The only thing wrong with it was that the stock firmware was a little dated and I had a free Sunday, which in retrospect is the most dangerous combination known to anyone who owns a soldering iron.
the temptation
OpenWrt had recently picked up support for this exact model, and there's a particular itch that comes from knowing your hardware could be running something better. The stock firmware was fine. OpenWrt would let me run proper VLANs, a real package manager, and the kind of fine-grained traffic shaping that the vendor UI gently pretended didn't exist. The device table said it was supported. There was a sysupgrade image. How hard could it be.
I will tell you how hard it could be.
the flash
The first flash went through the web UI and appeared to succeed. The device rebooted. And then it sat there, power LED on, every other light dark, no response on any address I tried, no DHCP, nothing. A brick. A small, warm, useless brick that an hour earlier had been a perfectly good router.
I did the things you do. Held the reset button for thirty seconds. Tried the failsafe address on a static IP. Tried TFTP recovery, which the bootloader on these is supposed to support, sitting there patiently serving a recovery image to a device that showed no sign of asking for one. Nothing took. Whatever had gone wrong, it had gone wrong early enough in the boot that none of the friendly recovery paths were available.
opening it up
So I opened it. Of course I opened it. The whole point of buying hardware you can tinker with is that when it goes wrong you get to find out why, and the answer almost always lives on a set of unpopulated pads somewhere near the SoC.
There they were: four little holes in a neat row, the unmistakable signature of a serial console header. Ground, transmit, receive, and a power pin you very deliberately do not connect. I soldered in a header, dug out a USB-to-TTL adapter, and the crucial detail that catches everyone the first time is the voltage. These are 3.3V serial, not 5V, and certainly not the RS-232 levels the name "serial" might trick you into reaching for. Get that wrong and you turn a recoverable brick into a permanent one. I checked with a meter before connecting anything, twice, because at that point I'd lost all faith in my own judgement.
screen /dev/ttyUSB0 115200
And there it was. Boot log scrolling past, the bootloader coming up, and then the device trying to load a kernel that plainly wasn't there or wasn't valid. The flash had written a bad image and left the partition in a state the device couldn't boot from, but the bootloader itself was alive and well. That's the whole game with a brick: if the bootloader still talks to you, you're not bricked, you're just inconvenienced.
the recovery
The bootloader had a TFTP client built in, the proper kind you drive from the serial console rather than hoping the device asks nicely on its own. From the bootloader prompt I could set the device and server IPs by hand, point it at a TFTP server on my laptop serving a known-good OpenWrt initramfs image, and tell it to load and boot directly into RAM.
ar7240> setenv ipaddr 192.168.1.1
ar7240> setenv serverip 192.168.1.2
ar7240> tftpboot 0x81000000 openwrt-initramfs.bin
ar7240> bootm 0x81000000
It loaded. The image came up in RAM, which is to say the router was now running a fully working OpenWrt entirely from memory, with nothing written to flash yet. From there it was a normal LuCI session, a fresh sysupgrade to a verified image written properly this time, and a reboot into a device that was, finally, exactly what I'd set out to make it three hours earlier.
what i actually learned
The OpenWrt install is great, for what it's worth. Everything I wanted from it, it does, and the router's been flawless since. But that's not really the lesson.
The lesson is that "it's supported" and "the flash will go cleanly on my specific unit" are two very different statements, and the gap between them is exactly where evenings disappear. Hardware that exposes a serial console is hardware you can almost always rescue, which is a brilliant argument for buying the tinker-friendly stuff in the first place. And a device that was working perfectly is, by definition, a device with nothing to gain and everything to lose from a Sunday-afternoon firmware adventure.
I'd do it again, obviously. I always do. But I keep that USB-to-TTL adapter in the drawer now, right next to the router, like a fire extinguisher I'm absolutely certain I'll need again.