This is recreated from someone's JTAG dump and the full header copy that happens to be located near the end of the ROM with the extra padding stripped out to match the known -TM variant's length. Do not be surprised if the GUI upgrade script does not take this file. Instead, you will need to use JTAG to flash the 4MB file if it does not take. TFTP will also take the JTAG dump, but the OEM CFE handling is a bit different.