Is my 13-month-old RBR50 bricked?

Thanks for the suggesition....  I just tried all that again, uising the PSU from my satellite... 

Same initial symptoms (no broadcast SSID, no DHCP response on wired ports);

neither the regular factory reset, nor the 30-30 harder reset worked.

The router powers up to a blinking white ring (one fllash every two seconds). Adter a minute or so this changes to a pulsing/throbbing white (once every 3s).  It is broadcasting no SSID that I can see.   After 5 minutes or so, the ring goes magenta.  (This is at least expected -- it's not connected to my cable modem since I'm still using my backup wifi router for internet access)

The symptoms seem similar to other people's reports of failed firmware updates.  But the behavior of the power LEDs seems normal - it's just the router doesn't respond on either the WIFI or wired interfaces.  

Yes - I found some info in other threads about how to connect a serial line to the device and cause it to stop in the bootloader.

https://community.netgear.com/t5/Orbi/Orbi-RBR50-seems-stuck-in-boot-loop/m-p/1948614/highlight/true#M98222

https://community.netgear.com/t5/Orbi/Force-RBR50-to-TFTP-for-un-brick/m-p/2010123#M107369 

You need to open up the router (2 Torx T10 screws behind the label that surrounds the network ports

Then you need top remove the board from the case (the serial line is on the underside)

You connect up 3 wires to a a header on the board (using a $12 USB serial port adapter from amazon as per the PDF file here: https://www.snbforums.com/attachments/orbi-serial-port-pdf.23898/

You connect to your router using a terminal program on your laptop/pc. (see https://pbxbook.com/other/mac-tty.html)

Then when you power on the router you should see some log messages ...and after a few secons it will say :

Hit any key to stop autoboot: 2

You have 2 seconds to press a key and then it drops into the U-Boot command line.

Type 'help' to see a list of commands like:

(IPQ40xx) # help
?       - alias for 'help'
base    - print or set address offset
board_backhaul_passphrase_set- Set backhaul passphrase on board
board_backhaul_passphrase_show- Show board_backhaul_passphrase
board_backhaul_ssid_set- Set backhaul ssid on board
board_backhaul_ssid_show- Show board_backhaul_ssid
board_data_set- Set board data on board
board_data_show- Show board_data
board_hw_id_set- Set board_hw_id
board_hw_id_show- Show board_hw_id
board_model_id_set- Set board_model_id
board_model_id_show- Show board_model_id
board_parameters_set- Set WPS PIN code, Serial number, SSID, Passphrase, Board data, MAC address
board_parameters_show- Show WPS PIN code, Serial number, SSID, Passphrase, MAC address.
board_passphrase_set- Set passphrase on board
board_passphrase_show- Show board_passphrase
board_ssid_set- Set ssid on board
board_ssid_show- Show board_ssid
boot_partition_set- Set boot partition data on board
boot_partition_show- Show boot partition
bootdni - Check DNI image file.
bootipq - bootipq from flash device
bootipq2- bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
button_test- Test buttons
calculate_address- Calculate the address of rootfs.
check_dni_image- Check DNI image file.
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
dnisetenvmem- set environment variable from memory
echo    - echo args to console
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
fuseipq - fuse QFPROM registers from memory
fw_recovery- start tftp server to recovery dni firmware image.
fw_recovery_second- start tftp server to recovery dni firmware image.
go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
incenv  - increment environment variable
ledctl  - ledctl - Test LEDs
loop    - infinite loop on address range
macset  - Set ethernet MAC address
macshow - Show ethernet MAC addresses
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmc_loadn_dniimg- load dni firmware image from EMMC.
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
nmrp    - start nmrp mechanism to upgrade firmware-image or string-table.
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
reset_i2c- Reset I2C
reset_i2c_to_blink- Reset I2C to blink
reset_i2c_to_zero- Reset I2C
rnset   - set region number
rnshow  - Show Region Number on Board
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
smeminfo- print SMEM FLASH information
snset   - Set serial number
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
uartrd  - uartrd read from second UART
uartwr  - uartwr to second UART
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
wpspinset- Set wpspin number

Since my router has lost all its config, including the ethernet MAC address, I needed to use `macset` before it would talk on the network.  It came up with the IP address 192.168.1.250  (not 192.168.1.1 as every other article mentions!)

Then I tried to use `fw_recover` which starts a TFTP server that you can send a firmware image to.

From my Mac I started `tftp  192.168.1.250 69`

Then you need to select binary mode by using the `binary` command

Then you can try 'put firmware.img`

This failed the first two time - I got the folliwing errors:

HW ID on board:
HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4

and

MODEL ID on board:
MODEL ID on image: RBR50
Firmware Image MODEL ID do not match Board model ID

I fixed these using the `board_hw_id_set` command and the `board_model_id_set` command.

I also set the serial number, SSID and passphrase to the values on the label on the bottom of the router - but it appears to ignore these! 

Then the new firmware uploded and the router rebooted itself.

At this point I could point a web browser at http://192.168.1.250 (using the *wired* LAN interface) and it gave me the option to setup the router manually with a new SSID, password etc.

Note that the wireless interface came up with a bogus SSID of NETGEAR75 that I couldn't connect to .  You need to use wired ethernet for the recovery process.

Let me know if you have any questions!

P/