Quick update before the weekend (it's a busy day, and I want to thank for help). So this is "pseudo-random order".
The crucial help was RobertBuroman's link to HowlingWolf's new firmware, and that's a huge thankyou, Robert! It did fix the download config button (I had to hard reset or reboot or default config it or power cycle, to get that to happen, thanks for the tip BritBrat!).
That also means, if I
didn't want to use Wolf's FW or I get issues in future, I have options and workarounds. I can switch to any other firmware, list my desired changes, and either (a) flash Wolfs FW, change, save, revert to preferred FW, or (b) manually edit the saved XML config now that I have at least some reasonable saved config as a starting point, since "upload config" was working anyway, or even (c) use the squashfs webGUI unpacker/repacker to compare the GUI side and see if I can manually add the "save config" fix to the old FW.
I can't say on under 24 hours how Wolf's FW would perform in continual daily use. So far no issues and looking very good. I tested with parallel ISO downloads (streamed files) and massively seeded random torrents (random packet data) and with both, I'm getting the maximum my line will support even with fibre terminating almost 1/2 a mile away (~ 40 down, router+windows both reporting 4.9-5.0 MB/s sustained) with it, and the main router reports almost no packet loss even under those loads (was always a few % under ADSL), and low latency (6.5ms). But it's too soon to tell anything about stability, UDP or other issues. Telnet see below. The GUI
seems fine except for one minor quirk:
On the other issues - Telnet seems "odd". It was inaccessible, and then later became accessible, under the firmware I (and BritBrat) first referenced, but I don't know what made the difference - not firewall on the client for sure. Then when I switched to Wolf's firmware it's stopped working again and I haven't got in since. I am not sure that's anything to do with Wolf's FW or not though, since it wasn't consistent on the other FW either and I don't know what factors affected it. Login timeout not played with yet so no idea if it's telnet only timeout, or GUI too. I wish it was clearer if ":5" timeout was intended to mean 5 seconds or 5 minutes! Haven't looked for Firewall log yet but my back-end router handles that for the LAN, so this would just be covering connection attempts to the HG612 itself.
So thank you, all, so far! That's where it is at for now. It is good enough to consider "can allow to bed in", rather than "OMG must fix". Have a good weekend/week!