Xiaomi/Chuangmi ipc017 kept on its vendor U-Boot. A kernel fragment appends mtdparts= with the vendor MXP offsets under OpenIPC's names plus panic=20, and carves a separate 64 KB env out of the end of the vendor DATA partition, because the vendor environment shares its erase block with the end of U-Boot. S01fwenv points fw_env.config at that partition. wireless/usb powers the MT7601U on GPIO 14 and bind-mounts a /tmp copy of MT7601USTA.dat with the factory MAC from FACTORY. S41eth0 takes the connector-less eth0 down so ONVIF discovery goes out on wlan0. Tested on hardware.
