Not entirely certain which chipset it has but there's some evidence from Googling around that it's a BCM 63168.
I, like you, found a hint that it uses the
Broadcom 63168 chipset but nothing was definite. So I downloaded the source code for the initial firmware image (~674 MB) and took a look inside . . .
The
D6400-V1.0.0.22_with_toolchain_src/D6400_GPL_Src/ directory contains the following --
[Duo2 D6400_GPL_Src]$ ls
bcmdrivers hostTools make.common Makefile prebuilt release targets version.make
data-model kernel make.deprules make.modsw README shared userspace
[Duo2 D6400_GPL_Src]$
Note the directory
bcmdrivers, which confirms
Broadcom. Let's see what the
README file contains --
[Duo2 D6400_GPL_Src]$ cat README
BCM963xx Consumer Release Notes
This release contains all of the files needed to build a BCM963xx DSL Router
image. To build an image, enter:
# make PROFILE=<profile_name>
For example,
# make PROFILE=96368GW
The final image is located in the images subdirectory. This image can be
specified in the BCM963xx Web interface image upgrade item in order to
upgrade the DSL router image.
[Duo2 D6400_GPL_Src]$
So now we know
BCM963xx.
Performing a crude recursive grep of everything for a mention of 63168 returns --
[Duo2 D6400_GPL_Src]$ grep -R 63168 *
bcmdrivers/opensource/net/enet/impl5/eth_pwrmngt.c: msleep(1); /* Without this, the speed LED on 63168 stays on */
bcmdrivers/opensource/net/xtmrt/impl5/xtmrt_runner.c: * BCM63168 SAR.
bcmdrivers/opensource/char/board/bcm963xx/impl1/board.c: /* Force BCM63168, BCM63169, and BCM63269 to be BCM63268) */
bcmdrivers/opensource/char/board/bcm963xx/impl1/board.c: if( ( (r & 0xffffe) == 0x63168 )
<snip>
Nothing conclusive.

Finally I had a quick rummage around in the
D6400-V1.0.0.22_with_toolchain_src/D6400_GPL_Src/bcmdrivers/broadcom/include/bcm963xx/ directory. It contains the following files --
[Duo2 bcm963xx]$ ls
adsldrv.h AdslMibDef.h atmapidrv.h bcmadsl.h bcmatmapi.h bcmmii_exports.h bcmsw_api.h bcmxdsl.h bpm.h DiagDef.h ingqos.h VdslInfoDef.h
[Duo2 bcm963xx]$
Something compelled me to look at the
VdslInfoDef.h header file. One section of it shows --
/* VdslPhys status definitions */
#define kVdslPhysStatusNoDefect (1 << 0)
#define kVdslPhysStatusLOF (1 << 1) /* lossOfFraming (not receiving valid frame) */
#define kVdslPhysStatusLOS (1 << 2) /* lossOfSignal (not receiving signal) */
#define kVdslPhysStatusLPR (1 << 3) /* lossOfPower */
#define kVdslPhysStatusLOSQ (1 << 4) /* lossOfSignalQuality */
#define kVdslPhysStatusLOM (1 << 5) /* lossOfMargin */