Two root causes prevented BCM4500 init block writes from completing:
1. Init block data arrays included length prefix bytes from the stock
firmware's XDATA format (17-byte blocks at code:0x0B4F). The stock
firmware reads byte 0 as length and writes bytes 1..N to A7.
Blocks 0 and 1 had the length prefix (0x06, 0x07) as the first
data byte, corrupting the DSP's indirect register FIFO.
2. The BCM3440 gateway's A8 register does not clear bit 0 after
indirect write commands (0x03), even though the BCM4500 processes
them successfully (confirmed via direct address 0x08 where A8
transitions from 0x03 → 0x02). bcm_poll_ready() now treats
gateway timeout as success with a settling delay.
Boot now completes reliably in ~0.96s through all stages:
GPIO → power → reset → PLL/DSP load → init blocks 0,1,2 → 0xFF.
Ryan Malloy
29df688f28