[Hardware investigation] Sagemcom FAST5670V2IL HW4 – silent UART, SPI NOR/eMMC, OpenWrt support?

[tamer sapri]

Hello OpenWrt developers,

I own a Sagemcom FAST5670V2IL, hardware HW4, supplied by Bezeq/YES,
and I am investigating whether it can support OpenWrt or another
custom Linux build. I would appreciate concrete
hardware/serial-console guidance.

Hardware observed on my board:
- PCB: GPON-BCM114-0013 REV1.0
- Firmware: BZ_SGF313 (Bezeq_EM-v0.51.0)
- SPI NOR: Macronix MX25V1606F, 16 Mbit (2 MiB)
- eMMC: Samsung KLM4G1FETE-B041, 4 GB
- RAM reported in management API: Total=971832 (presumed KiB)
- A related FCC F at ST5670V2 photo reportedly shows Broadcom BCM68360. I
have not independently verified the SoC on my particular HW4 board.
- Bootloader type and Secure Boot status unknown.

Tests already performed:
1. Web GUI / XMO API: Access at http://10.0.0.138/2.0/gui/ via POST
/cgi/json-req. Inspected scripts.js, xmo.js, gui-api.js and config.js.
Recorded 239 HTTP requests and about 2,476 XMO actions through Burp,
mostly getValue/getEvents. No firmware extraction, shell or bootloader
control was found. BootloaderVersion returned an empty string and
Processors an empty list.
2. Web-admin elevation: Setting RootAccountEnable allowed login as GUI
Admin but did NOT provide Linux root or SSH access.
3. SSH: Dropbear 2018.76 is present on TCP 22. Authentication using
management credentials failed. A factory reset restored
LANAccess=false; no usable shell.
4. UART: A CH340 adapter passed loopback. Tried 115200 8N1, COM4,
observing cold boot with PowerShell and terminal applications. No RX
data. Pads marked J1004 / CN1 are candidates but pinout and voltage
are unverified. A previous back-powering concern means I will not
repeat attempts to inject VCC into the board.
5. Recovery: Reset-held power-on did not reveal confirmed rescue mode.
Ethernet capture during boot showed normal ARP/DHCP but no TFTP/BOOTP
request. GUI backup was AEAD10-encrypted configuration, not firmware.
Diagnostic RPC attempts did not produce a dump.

I have an RT809F programmer, but I have NOT read or modified the SPI
NOR or eMMC. I intend to preserve the original images and avoid
destructive changes.

Could someone help answer:
- Is FAST5670V2IL HW4 or this PCB known to the OpenWrt community? Is
its Broadcom platform realistically supportable, including Wi-Fi?
- Is there a confirmed UART TX/GND pinout and logic level for this
exact board, or a safe read-only method to identify it?
- Which storage is likely to contain the initial bootloader (2 MiB SPI
NOR or 4 GB eMMC), and what read-only evidence would be most useful
next?
- Are there documented recovery mechanisms, bootloader details, or
evidence for/against Secure Boot on this particular revision?
- Would clear board photographs and two matching read-only SPI dumps
with hashes help with a feasibility assessment?

Please advise what specific evidence would help most and whether a
developer/hardware specialist has worked on this revision. I can
supply redacted traces and board photos.

Thank you.