There's a few things that should be ported over from the qca-wifi (public) git repository. I'll add to this ticket as I find things to port.
* there's some hornet (AR9331) specific otp initialisation code which I _think_ is setting up various thermal / regulator parameters.
* there's a WAR in ar9300_set_reset() for the AR9331 which asks the SoC to get involved if it's a cold reset. Ie, it actually does a full wireless mac/phy/radio reset via the SoC path rather than a straight cold reset via the normal MAC/RTC path.