[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] addisu:
I have extracted an eeprom image from a different location than previously mentioned and was able to get passed uploading the eeprom in the first call of IPC_DeviceIoControl. So it looks like its worse than before because it doesn't get passed this first call but it is now able to the find NVS version number and Radio type. However, once its done with the eeprom stuff, the phone freezes.

Here is what I did to extract the eeprom image. I found an eeprom from a G1 user and found his mac address and figured out the offset to start extracting from. I believe all mac address for the Kaiser start with HTCs OUI 00-18-41. This is backwards in the eeprom file because the ARM is little endian. The eeprom image from the G1 user was only 752 bytes as opposed to 256K.

dd if=mtdump.img of=calibration bs=1 count=752 skip=38797376

where mtdump.img is my entire flash dump using instructions from here

Here is my dmesg log

[ 163.547855] TIWLAN: Driver loading
[ 163.696973] trout_wifi_power: 1
[ 163.697010] trout_wifi_reset: 0
[ 163.734118] trout_wifi_set_carddetect: 1
[ 163.734143] mmc0: card_present 1
[ 163.734165] mmc0: Slot status change detected (0 -> 1)
[ 163.741691] mmc0: Command timeout
[ 163.746371] mmc0: card claims to support voltages below the defined range. These will be ignored.
[ 163.746421] mmc0: SDIO card claims to support the incompletely defined 'low voltage range'. This will be ignored.
[ 163.748845] clk_set_rate 19:20000000
[ 163.750448] set sd clock - 0 1
[ 163.824793] mmc0: new SDIO card at address 0001
[ 163.828598] TIWLAN: Found SDIO controller (vendor 0x104c, device 0x9066)
[ 163.833705] TIWLAN: Driver initialized (rc 0)
[ 163.833933] TIWLAN: 1251 PG 1.1
[ 163.833965] TIWLAN: Driver loaded
[ 163.930073] TIWLAN: ti1610_do_ioctl(cmd=2242612(SET)) - user_data_pointer=0x40009008, len = 194375, aval_data_size=4
[ 163.930073] TIWLAN: ti1610_do_ioctl() - alloc 194375 bytes
[ 163.930073] TIWLAN: TIWLN_SET_INIT_INFO: el=752 il=8222, fl=185388
[ 163.930516] TIWLAN: --------- Eeeprom=c47cf814(752), Firmware=c72e1014(185388)
[ 163.930958] TIWLAN:
[ 163.930970] ++++++++++++
[ 163.930978] EEPROMlessModeSupported = 0 # 0 = disable epromless support / 1 = Enable
[ 163.930995] WME_Enable = 1 # 0 = diable WME support / 1 = Enable
[ 163.931010] dot11NetworkType = 3 # 2 - A only mode, 3 - B/G mode, 4 - A/G Dual mode
[ 163.931026] RecoveryEnable = 1 # 0 - Disabled, 1 - Enabled
[ 163.931041] TriggerFcs = 0 # 0 - Disabled, 1 - Enabled
[ 163.931055] dot11FragmentationThreshold = 4096
[ 163.931065] dot11RTSThreshold = 4096
[ 163.931075] WPAMixedMode = 1
[ 163.931081] RSNPreAuthentication = 1
[ 163.931091]
[ 163.931096] CalibrationChannel24 = 1
[ 163.931106] CalibrationChannel5 = 36
[ 163.931115]
[ 163.931121] # Regulatury Domain tables.
[ 163.931130] # Each byte correlates to one channel in sequential order. Table 2.4 starts from channel 1, Table 5.0 starts from channel 36.
[ 163.931153] # Bits 0..4 - Max power allowed in Dbm.
[ 163.931165] # Bit 6 - Channel is allowed for Active scan
[ 163.931176] # BIt 7 - Channel is allowed
[ 163.931186] AllowedChannelsTable24 = FFFFFFFFFFFFFFFFFFFFFFFFFFFF
[ 163.931200] AllowedChannelsTable5 = FF000000FF000000FF000000FF000000FF000000FF000000FF000000FF0000000000000000000000000000000000000000000000000000000000000000000000FF000000FF000<6>TIWLAN: 654.633783:
[ 164.125858] CONFIG_MGR, INIT: ***** CORE CREATION SUCCESS *****
[ 164.125881]
[ 164.125888]
[ 164.125916] TIWLAN: 654.633920:
[ 164.125943] createDriver(): pConfigManager->hOs c5e80000 pConfigManager->hMemMgr c576d674!!! :
[ 164.125960]
[ 164.126141] TIWLAN: 654.634140: whalCtrl_Create end c0c8ae14
[ 164.126650] TIWLAN: 654.634616: TnetwDrv_Create: CREATED !!!
[ 164.126723] TIWLAN: 654.634725:
[ 164.126750] createDriver(): pConfigManager c4e6e414 pConfigManager->hTnetwDrv c4e4a0d4!!! :
[ 164.126768]
[ 164.126795] TIWLAN: 654.634796:
[ 164.126813] CONFIG_MGR, INIT: ***** CREATION SUCCESS *****
[ 164.126828]
[ 164.126833]
[ 164.127146] set gpio 29 wakeup 40000000
[ 164.128375] TIWLAN: 654.636356: Working on a 1251 PG 1.1 board.
[ 164.128523] TIWLAN: 654.636521: Starting to process NVS...
[ 164.128565] TIWLAN: 654.636566: In pWhalBus->pEEPROMBuf
[ 164.128595] TIWLAN: 654.636600: whal_FwCtrl_EepromlessStartBurst: EEPROM Image addr=0xc47cf814, EEPROM Len=0x0x2f0
[ 164.128800] TIWLAN: 654.636800: Get NVS file information: NvsDataLen = 0x2b0 TableAddr 0x2d42c upper 0x0
[ 164.132328] TIWLAN: 654.640351: NVS version 6.3.2 found.
[ 164.132386] TIWLAN: 654.640428: Radio type is 0x1C.
[ 164.134220] TIWLAN: 654.642253: Finished processing NVS.
[ 164.160074] TIWLAN: 654.688778: Finished downloading firmware.
[ 164.160074] TIWLAN: 654.688928: Firmware running.