I checked out Buffalo firmware's for WBR-G54 and WLA-G54 accesspoints and they also contains cramfs image.
http://www.buffalotech.com/wireless/downloads/firm ware/WLAG54_final.zip
cramfs image starts at 0xC002F
http://www.buffalotech.com/wireless/downloads/firm ware/WBRG54_final.zip
cramfs image starts at 0xC0022
It clearly shows that Broadcomm has distributed reference design for accesspoint to all hardware makers with source and modified GCC compiler.
I checked out Buffalo firmware's for WBR-G54 and WLA-G54 accesspoints and they also contains cramfs image. http://www.buffalotech.com/wireless/downloads/firm ware/WLAG54_final.zipm ware/WBRG54_final.zip
cramfs image starts at 0xC002F
http://www.buffalotech.com/wireless/downloads/fir
cramfs image starts at 0xC0022
It clearly shows that Broadcomm has distributed reference design for accesspoint to all hardware makers with source and modified GCC compiler.