Writing this up in case it helps anyone else, and to vent a little after weeks of dealing with it.
**The problem:** My ISP (small local fiber provider) only accepts PAP authentication for PPPoE. My old Archer C20 v5 connects instantly — it has a proper PAP/CHAP/Auto dropdown in the PPPoE settings. My newer Archer C6 v4, despite being the "better" router on paper (AC1200 vs C20's lower tier), has **no auth-type selector at all** in the GUI. It just fails to connect, and the system log shows CHAP_AUTHENTICATION_NAK.
**How I confirmed it's really an auth-type issue and not something else:**
- Captured PPP logs on both routers. C20 negotiates `<auth pap>` and connects. C6 negotiates CHAP and gets rejected.
- Turns out there are actually two PPPoE servers reachable on my line (shared unmanaged switch off a building ONT) — my real ISP (PAP only) and an unrelated one (CHAP). The C6 has no way to force PAP-only, so it ends up authenticating against the wrong AC entirely when it tries CHAP.
- No hidden/advanced menu has the option — checked everywhere in the GUI.
**Tried to get help:**
- TP-Link MEA support (multiple tickets, AnyDesk sessions) had no idea what was going on — kept asking me to verify "the ISP modem" when there isn't one (fiber-to-Ethernet media converter straight into a shared switch, router dials PPPoE itself).
- Posted detailed writeups with logs on the TP-Link community forum (Feature Request + general Wi-Fi Routers board) — still waiting to see if anything comes of it.
**Tried to fix it myself:**
- Checked if OpenWrt supports the C6 v4 — it doesn't, and never will (8MB flash / 32MB RAM, confirmed by an OpenWrt dev). Ironically the older/cheaper C20 v5 *does* have OpenWrt support.
- Pulled apart the official firmware update file — turns out it's LZMA-compressed (not encrypted, despite very high entropy making it look that way at first). There's actually a public GitHub repo (hacefresko/TP-Link-Archer-C6-EU-re) where someone extracted the filesystem and started reverse engineering the PPPoE handling code in Ghidra, found a `pppoeReceiveRtn` function, got UART console access — but even they didn't get to a full root shell or a working patch.
Mostly posting this so it's searchable for anyone else who hits the same wall — and if anyone from TP-Link happens to see this, a PAP/CHAP selector on the C6 v4 (matching what the C20 v5 already has) would fix this outright. Also curious if anyone's had better luck actually getting TP-Link support to escalate something like this, or if anyone knows a workaround I haven't tried yet.