Reconstructed U-Boot environment (NOT a captured `printenv`; CRC is currently BAD -> board boots to compiled-in defaults). Fields known from boot log + bootargs + MTD layout:

bootcmd=sf probe 0:0 1000000 0; sf read 0x42000000 0x30000 size 0x110000; bootz 0x42000000
bootargs=console=ttyS0,115200 rdinit=/sbin/init root=/dev/mtdblock2 ro rootfstype=squashfs clk_ignore_unused loglevel=7 mem=34M reserved-memory=30M@0x12200000 coherent_pool=256K ethon=n
CONFIG_ENV_OFFSET=0x7e0000  CONFIG_ENV_SIZE=0x00020000  (128 KiB tail of XM25QH64C 8 MiB SPI-NOR)

Plan (pending SOIC8 clip arrival): patch env at 0x7e0000 -> rdinit=/sbin/init replaced by init=/bin/sh, full 128 KiB CRC recomputed, layout-scoped flashrom write (-l ax520_env.layout -i config -w) so only env region is touched; comboot/kernel/rootfs/app preserved. Roll-back = restore original env only.