Both stock and our custom firmware report the same status
  progression (0x00 → 0x03 → 0x07), but the stock firmware's
  BCM4500 initialization actually works (SNR raw ~64000) while
   the custom firmware's returns all zeros. The custom
  firmware's bcm4500_boot() silently fails somewhere in the
  I2C init block writes — it sets BM_STARTED | BM_FW_LOADED
  but the hardware isn't actually running. This is a firmware
  bug that needs investigation.