Physical address of the flash is 0xbfc00000. Flash map: 

0000 - DFFF 56Kb - board_data + default config * 
E000 - 4FFFF 264Kb - bootloader (vxworks ?) 
50000 - 257FFF 2080Kb - firmware image (without 128 bytes header) ** 
258000 - 3fBFFF 1680Kb - configuration (web pages?) ** 
3fC000 - 3FFFFF 16Kb - rf eeprom (calibration) 

* board_data + default config details 
0000 - 00ff 256b - bootstrap (16 bytes, jump to bootloader ?) 
- board data (BOARD_CFG_T ar5212_attach.c) 
- WIFI mac adrress offset 0x44 
0100 - 1FFF 7936b - filled by 0xff 
2000 - 3FFF 8Kb - default configuration, filled to size by 0xff 
4000 DFFF 40Kb - filled by 0x00 

** posible space to flash any things 3760Kb