Well after a bit of adding wires here and there and reading out the data using serial to wifi module, I can confirm the fault with the R6 that I got is indeed the firmware in the flash chip that is faulty.
Its not been fully programmed as most of the firmware is incomplete or corrupt.
Hence why it sticks just after the u-boot part has loaded.
This is a problem as the firmware is not available as a download anywhere for the R6.
If I had the firmware bin , I could just re flash the chip and my R6 would work!
I dont fancy having to purchase yet another R6 , just to get a dump of the flash chip!
Anyway I was curious what would happen if I took a copy of the flash from the Actual S6 craft and then flashed that into the R6??
Well I did just that and with the serial lead attached I watched it boot and load and checking on my phone a wifi connection came up to controller named of course wingslandS6_air_xxxx
And I could connect to it no probs. So this proves the hardware is working fine, this was let down by badly programed firmware to the wifi module.
Inside the box when I purchased it , it has a quality control stamp. I guess the manufactures dont actually check these work before they stamp them passed!!
Funny checking in wingsland app it shows this under firmware 😉
It thinks the flight control is R6M70422 !
Of course this really refers to what inside the R6.
From digging around, it seems the firmware is pretty similar between the S6 and R6.
They both use OpenWRT and same version.
I was able to see that by using binwalk and extracting the working S6 firmware and the bits which were in the corrupt R6 chip.
But the remote uses a different program on boot, the S6 uses wingsland_server and the remote uses wingsland_remotelet
There are prob also some other config files differences.
Maybe a way to cobble together if we had ssh access to the running system, but its locked out.
Easiest way would be if someone else had a working dump of the flash chip from the R6 wifi module that I could use.
Cant see too many willing to rip apart there R6 and unsolder the chip to read it and so I will next try and get root access to the wifi module.