hardware fixes

Apple Airport technical description
M7601LL/B Version 1.0 (w/ Lucent Silver Card supporting 40bit encryption)
M8209LL/A Version 2.0 (w/ Lucent Gold Card supporting 128bit encryption)
Same hardware sold as Lucent RG-1000 and HP HP-P1981A

Apple Airport Lucent RG-1000 w/ Orinoco silver (HP labeled)

The Apple Airport Base Station is actually a tiny embedded x86 PC. Most of the functionality is incorporated into one chip, the AMD ELAN SC400 microcontroller.
The software which is stored in a flash ROM features an embedded BIOS by General Software Inc. and KarlNet's KarlBridge software.

Apple Airport hardware
1x AMD ELAN SC400-33 CPU (user manual / register manual)
2x VG26V18165 DRAM chips (1Mx16bit each) which gives a total of 4MB RAM. Timing and memory mapping is controlled by the ELAN's memory controller.
1x AMD AM29F040B 512kx8bit flash which gives a total of 512kB of socketed FLASH.
1x AMD AM79C961A PCnet II Ethernet controller with a 10BaseT transceiver. The registers are accessible at IO port 0x300, it's using IRQ 10.
2x ISSI IS61C256 (32kx8bit each) static RAM which gives a total of 64kB shared memory needed for AM79C961A. Memory resides on the ISA bus at 0xD0000.
1x PCMCIA wireless LAN card (most likely Lucent Orinoco silver).
1x Conexant RP56D modem hooked to serial port of AMD ELAN.

Memory map
AMD ELAN has a usable physical address range of 0x0000000 - 0x3FFFFF. The memory map is as follows:
0x000000 - 0x09FFFF Base Memory
0x0A0000 - 0x0BFFFF Empty
0x0D0000 - 0x0DFFFF Shared Memory for Ethernet Controller
0x0E0000 - 0x0EFFFF KarlBridge core software (Next to 0x0EFFFF)
0x0F0000 - 0x0FFFFF Embedded BIOS
0x100000 - 0x3FFFFF Extended Memory

The flash ROM content can be divided into four parts:
0x100 .. 0x100 + 17336 A block of 17336 bytes holds the configurable base station parameters etc.
Here's what has been found out about this block so far.
0x100 + 17336 .. Immediately following, the KarlBridge main software image (Apple Firmware) is appended.
0x60000 .. 0x6ffff The next to top 64k hold the KarlBridge "core" software.
0x70000 .. 0x7ffff The top 64k hold the BIOS.
A flash of Apple Airport (firmware upgrade) overwrites section 1 and 2 (configuration AND firmware data).
A configuration change using base station configurator only overwrites section 1 (configuration data).

Additional links
A description with photos about how to exchange the wireless LAN adapter.
A page with more information and pictures about the airport internals.