[NAS542] Bricked device after custom firmware attempt - Stuck at "arch_number: 1094"

Title: [NAS542] Bricked device after custom firmware attempt - Stuck at "arch_number: 1094"

Hello everyone,

I'm hoping someone can help me unbrick my Zyxel NAS542.

Background:
I tried to replace the stock firmware with a custom one (Alpine Linux). The process failed, and now the device no longer boots. I have serial console access and can interact with the Barebox bootloader.

The Problem:
When I power on the device, it successfully loads Barebox, but it fails to start any kernel I try to flash. It gets stuck immediately after printing the arch_number. This happens with both the custom kernel I built and even when I flash the official Zyxel kernel.

Here is the complete boot log from the serial console when it tries to boot:


uloader 2011.06.0 (May 20 2014 - 16:36:41)
Board: Mindspeed C2000
c2k_spi_probe
Copying Barebox from SPI Flash(bootopt=0)
BB Copying Done
Starting Barebox at 0x01000000 ...
barebox 2011.06.0-svn44305-dirty6 (Aug 28 2014 - 22:25:22)
Board: Mindspeed C2000
c2k_spi_probe
c2k_otp_probe.
cbus_baseaddr: 9c000000, ddr_baseaddr: 03800000, ddr_phys_baseaddr: 03800000
class init complete
tmu init complete
bmu1 init: done
bmu2 init: done
util init complete
GPI1 init complete
GPI2 init complete
HGPI init complete
HIF rx desc: base_va: 03e80000, base_pa: 03e80000
HIF tx desc: base_va: 03e80400, base_pa: 03e80400
HIF init complete
bmu1 enabled
bmu2 enabled
pfe_hw_init: done
pfe_firmware_init
pfe_load_elf
pfe_load_elf no of sections: 10
pfe_firmware_init: class firmware loaded
pfe_load_elf
pfe_load_elf no of sections: 10
pfe_firmware_init: tmu firmware loaded
pfe_load_elf
pfe_load_elf no of sections: 14
pfe_firmware_init: util firmware loaded
eth_port: 0
NAS540_phy_reg_setting[eth_port].phyaddr: 0x4
miidev_restart_aneg for PHY4
eth_port: 1
NAS540_phy_reg_setting[eth_port].phyaddr: 0x6
miidev_restart_aneg for PHY6
cfi_probe: cfi_flash base: 0xc0000000 size: 0x04000000
Unknown FLASH on Bank at 0xc0000000 - Size = 0x00000000 = 0 MB
bootopt = 0x0
Using ENV from SPI Flash.
nand_probe: comcerto_nand base: 0xc8300000 size: 0x256 MB
NAND device: Manufacturer ID: 0x98, Chip ID: 0xda (Toshiba NAND 256MiB 3,3V 8-bit), page size: 2048, OOB size: 64
Using default values
Bad block table not found for chip 0
Bad block table not found for chip 0
Scanning device for bad blocks
... (skipping list of bad blocks for brevity) ...
Bad block table written to 0x0ffe0000, version 0x01
Bad block table written to 0x0ffc0000, version 0x01
Malloc space: 0x00600000 -> 0x01000000 (size 10 MB)
Stack space : 0x005f8000 -> 0x00600000 (size 32 kB)
running /env/bin/init...
Unknown command 'export' - try 'help'
Disabling eee function of phy 4 ...
Disabling eee function of phy 6 ...
Hit any key to stop autoboot:  0
Attempting to boot custom Alpine kernel...
Kernel: /dev/nand0.kernel1.bb
Bootargs: console=ttyS0,115200 pcie_gen1_only=yes usb3_internal_clk=yes mac_addr=78:C5:7D:19:AE:CE,78:C5:7D:19:AE:CF root=ubi0:rootfs ubi.mtd=5,2048 rw rootfstype=ubifs
Verifying Checksum ... OK
Image Name:   Linux NAS5xx
Created:      2025-10-20  19:05:19 UTC
Image Type:   <NULL> <NULL> <NULL> (<NULL>)
Data Size:    3988904 Bytes =  3.8 MB
Load Address: 00008000
Entry Point:  00008000
OK
Starting kernel ...
commandline: console=ttyS0,115200 pcie_gen1_only=yes usb3_internal_clk=yes mac_addr=78:C5:7D:19:AE:CE,78:C5:7D:19:AE:CF root=ubi0:rootfs ubi.mtd=5,2048 rw rootfstype=ubifs
arch_number: 1094
(...and it hangs here forever)

What I've Tried:

• Flashing the official kernel and rootfs extracted from the latest firmware .bin file.
• Building a custom kernel (v4.19) with the correct mvebu_v7_defconfig and LOADADDR.
• Using erase_old_nand_fmt to clean the NAND.
• Manually flashing the kernel and rootfs using tftp to RAM, then erase and cp -a to NAND.
• Setting bootargs manually: setenv bootargs 'console=ttyS0,115200 root=ubi0:rootfs rootfstype=ubifs'

No matter what I do, the kernel starts but hangs immediately after arch_number: 1094. It seems like it's failing to mount the root filesystem, but I get no "Kernel panic" message or any other output.

Does anyone know the correct procedure to recover from this state? Is there a specific combination of tools, firmware files, or Barebox commands that I'm missing?

Any help would be greatly appreciated. Thank you!