Well last time I faced something similar, it was a problem with the header, which I had a look at the logs using JTAG, and did something like below in order to trick the device to accept the firmware over TFTP. If you can record a session of the TFTP in action, I might be able to hint at the...