OK, I’ve unbricked the firmware. It looks like the TCP stack is broken in the following way: if a TCP SYN is received on port 80, but the SYN+ACK is lost, then no further SYNs will be responded to. There may be more to it than this, but the bottom line is that I was able to upload the stock firmware through u-boot using this information–the reason it wasn’t working before was a NAT problem, and when I bypassed the NAT the connection succeeded.

I suspect that this SYN problem is why you sometimes hear from people that they weren’t able to access the u-boot web page.